CVE-2026-109636 Overview
CVE-2026-109636 is a missing authorization vulnerability [CWE-862] in Frappe ERPNext. The flaw affects versions before 15.115.0 and 16.x versions before 16.26.0. Certain endpoints fail to enforce proper permission checks before returning data. Authenticated attackers holding low-privileged accounts can call these endpoints and read financial data outside their assigned role scope. The issue is network-reachable and requires no user interaction.
Critical Impact
Any authenticated user with a low-privilege ERPNext account can read restricted financial records by invoking endpoints that skip server-side permission validation.
Affected Products
- Frappe ERPNext versions prior to 15.115.0
- Frappe ERPNext 16.x versions prior to 16.26.0
- Deployments exposing ERPNext endpoints to authenticated users with low-privilege roles
Discovery Timeline
- 2026-10-12 - CVE-2026-109636 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109636
Vulnerability Analysis
Frappe ERPNext exposes server-side endpoints that return financial records. In the affected versions, several of these endpoints omit the authorization checks that bind data access to a user's role and permission profile. The server authenticates the session but does not evaluate whether the caller has read rights on the requested documents. This creates a horizontal and vertical access-control gap that returns financial data to users who should not see it.
The weakness is categorized as Missing Authorization [CWE-862]. It is a server-side logic flaw, not an input validation or injection issue. Exploitation does not require crafted payloads or chained vulnerabilities. A valid session token is sufficient. Because ERPNext is used for accounting, invoicing, and ledger operations, the exposed records can include customer financial details, invoice data, and internal accounting entries.
Root Cause
The root cause is the absence of permission enforcement on specific API endpoints. Frappe's permission framework must be invoked by handlers to validate role-based access on each request. The affected handlers do not call these checks before serializing and returning document fields, so role boundaries are not applied.
Attack Vector
The attack vector is network-based with low attack complexity. The attacker authenticates with any low-privileged ERPNext account, then issues HTTP requests to the vulnerable endpoints. The server returns financial data that the account's role should not expose. No privilege escalation, phishing, or client-side interaction is required.
No verified public exploit code is available at the time of writing. For technical specifics, consult the GitHub Security Advisory GHSA-g72f-g9wf-42vr and the VulnCheck Advisory on Frappe ERPNext.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109636
Indicators of Compromise
- Authenticated API requests from low-privilege user sessions to endpoints that return financial documents such as invoices, payments, or ledger entries.
- Spikes in GET traffic to Frappe document and report endpoints originating from accounts that normally only interact with non-financial modules.
- Session accounts accessing document types outside their assigned role profile within short time windows.
Detection Strategies
- Compare each user's requested document types against the role permissions assigned in ERPNext, and flag mismatches.
- Enable audit logging on Frappe document fetch and report endpoints, and ingest the logs into a SIEM for role-versus-access correlation.
- Hunt for sequential enumeration patterns against ERPNext API routes, which can indicate scraping of financial records.
Monitoring Recommendations
- Monitor web server and application logs for authenticated requests to financial endpoints from accounts that lack the corresponding role.
- Track unusual volumes of document reads per user and alert on deviations from baseline behavior.
- Review ERPNext user and role assignments regularly to ensure low-privilege accounts remain scoped to their intended modules.
How to Mitigate CVE-2026-109636
Immediate Actions Required
- Upgrade Frappe ERPNext to 15.115.0 or later on the 15.x branch.
- Upgrade Frappe ERPNext to 16.26.0 or later on the 16.x branch.
- Audit existing user accounts and revoke sessions for low-privilege users after patching.
- Review financial document access logs for the period prior to the patch to identify unauthorized reads.
Patch Information
The vendor has published fixed releases. Apply Frappe ERPNext 15.115.0 or 16.26.0 as appropriate for your deployment branch. Patch details are documented in the GitHub Security Advisory GHSA-g72f-g9wf-42vr.
Workarounds
- Restrict network access to the ERPNext instance so only trusted users can reach the application until patching is complete.
- Temporarily tighten role permissions and remove unnecessary low-privilege accounts that could abuse the flaw.
- Place a reverse proxy or web application firewall in front of ERPNext to log and rate-limit API access to document and report endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
