CVE-2026-109641: Frappe ERPNext Auth Bypass Vulnerability

CVE-2026-109641 Overview

CVE-2026-109641 is a missing authorization vulnerability [CWE-862] in Frappe ERPNext. The flaw affects versions before 15.110.0 and 16.x before 16.21.0. Certain endpoints fail to enforce authorization checks before performing record creation and availability lookups. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability data. The vulnerability persists even when an administrator has explicitly disabled the corresponding feature within the application.

Critical Impact

Unauthenticated remote attackers can create records and enumerate availability through endpoints that lack authorization enforcement, bypassing administrator-disabled feature controls.

Affected Products

• Frappe ERPNext versions before 15.110.0
• Frappe ERPNext 16.x versions before 16.21.0
• Deployments with affected endpoints exposed to untrusted networks

Discovery Timeline

• 2026-10-12 - CVE-2026-109641 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109641

Vulnerability Analysis

Frappe ERPNext exposes a set of HTTP endpoints that handle record creation and availability queries. The affected endpoints omit the authorization checks required before performing privileged actions. An unauthenticated client can reach these endpoints over the network and trigger backend operations that should require an authenticated session with appropriate role permissions.

The impact extends beyond simple access control bypass. The endpoints continue to accept requests even when an administrator has disabled the related feature in the application configuration. This breaks the expected security boundary where disabling a feature should remove its attack surface.

Root Cause

The root cause is missing authorization enforcement [CWE-862] at specific controller entry points. Developers did not apply the @frappe.whitelist() guest restriction, role checks, or has_permission validation to the affected handlers. As a result, the endpoints inherit guest-accessible behavior and skip verification against the administrator's feature toggle state.

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker sends crafted HTTP requests directly to the vulnerable ERPNext endpoints. Successful requests create records within the application database and allow the attacker to enumerate availability information. See the GitHub Security Advisory GHSA-38rx-wm3g-39m3 and the VulnCheck Advisory on ERPNext for endpoint specifics.

// No verified exploit code is published. Refer to the vendor advisory
// for the exact endpoint paths and affected controllers.

Detection Methods for CVE-2026-109641

Indicators of Compromise

• Unexpected record creation events in ERPNext DocType logs attributed to the Guest user or without a corresponding authenticated session
• HTTP POST requests to ERPNext API endpoints from unauthenticated sources returning HTTP 200 responses
• Spikes in record creation volume on features that administrators have disabled in site configuration

Detection Strategies

• Review Frappe audit logs and Activity Log DocType for records created by Guest or anonymous owners
• Correlate web server access logs with ERPNext endpoint hits lacking a valid sid session cookie
• Alert on availability-check endpoints returning data when the associated feature is marked disabled in System Settings

Monitoring Recommendations

• Forward Nginx or reverse proxy logs for the ERPNext site into a central logging platform for query and retention
• Enable Frappe's built-in request logging and monitor for repeated unauthenticated calls to API routes under /api/method/
• Track the ratio of guest-session requests to authenticated requests and alert on sudden deviations

How to Mitigate CVE-2026-109641

Immediate Actions Required

• Upgrade Frappe ERPNext to version 15.110.0 or later for the 15.x branch
• Upgrade Frappe ERPNext to version 16.21.0 or later for the 16.x branch
• Audit record creation activity for the period preceding the patch for signs of abuse by guest accounts
• Restrict external network exposure of ERPNext instances to trusted sources until the patch is applied

Patch Information

Frappe published fixes in ERPNext 15.110.0 and 16.21.0. These releases add authorization checks to the affected record creation and availability endpoints. Full remediation details are tracked in the GitHub Security Advisory GHSA-38rx-wm3g-39m3.

Workarounds

• Place the ERPNext site behind a reverse proxy that denies unauthenticated requests to the affected endpoints
• Use Frappe Website Settings and firewall rules to block guest access to /api/method/ routes that are not required for public use
• Disable the ERPNext features whose endpoints are affected and verify at the proxy layer that related URL paths return HTTP 403

# Example Nginx snippet to block unauthenticated access to a specific method
location ~ ^/api/method/erpnext\. {
    if ($cookie_sid = "Guest") { return 403; }
    proxy_pass http://frappe_backend;
}