CVE-2026-109667 Details
Description
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
A privilege escalation vulnerability has been identified in Frappe ERPNext versions prior to 15.111.0 and 16.x prior to 16.22.0. The vulnerability exists in a record-creation endpoint that accepts the record type from the request and inserts the record without performing proper permission checks. This flaw allows any authenticated user, regardless of their role, to specify a privileged record type, create privileged accounts, and gain full control of the site.
Users are advised to upgrade to Frappe ERPNext versions 15.111.0 or 16.22.0.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-269 | Improper Privilege Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe ERPNext | < 15.111.0 (semver) < 16.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |