CVE-2026-109656 Overview
CVE-2026-109656 is a missing authorization vulnerability [CWE-862] in Frappe ERPNext affecting versions before 15.118.2 and 16.x before 16.30.0. Certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers holding low-privileged accounts can call these endpoints and read item master data beyond their permitted role. The flaw exposes product catalog information, pricing structures, and inventory details that should remain restricted by role-based access control. Exploitation requires network access and valid credentials, but no user interaction.
Critical Impact
Low-privileged authenticated users can read item master data across the ERPNext instance, exposing confidential product, inventory, and pricing records intended for restricted roles.
Affected Products
- Frappe ERPNext versions prior to 15.118.2
- Frappe ERPNext 16.x versions prior to 16.30.0
- Deployments relying on role-based permissions for item master data
Discovery Timeline
- 2026-10-12 - CVE-2026-109656 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-109656
Vulnerability Analysis
The vulnerability resides in ERPNext endpoints that expose item master data without validating the caller's role against the standard permission model. ERPNext relies on role-based access control to restrict visibility of records in the Item doctype, including SKUs, descriptions, pricing attributes, and related metadata. The affected endpoints bypass the permission checks that normally gate direct document reads. Any authenticated user, including users assigned only basic desk access, can invoke the endpoints and retrieve records they should not see. The impact is confined to confidentiality: integrity and availability of item records are not affected by this flaw.
Root Cause
The root cause is a missing authorization check [CWE-862] on API endpoints that return item master records. The endpoints trust the authenticated session without re-evaluating whether the session's role has read permission on the Item doctype or specific item fields. This breaks the assumption that document-level permissions are enforced uniformly across all read paths.
Attack Vector
An attacker authenticates to the ERPNext instance using any low-privileged account, including self-registered or employee accounts without item management roles. The attacker then issues HTTP requests to the affected endpoints and receives item master data in the response. No privilege escalation, user interaction, or chained vulnerability is required.
No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-4j82-w8f7-hqqp and the VulnCheck Advisory for Frappe ERPNext for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-109656
Indicators of Compromise
- Repeated authenticated HTTP requests from a single low-privileged user to item-related API endpoints such as /api/method/ and /api/resource/Item.
- Unusually large result sets returned to accounts that lack the Item Manager or Stock User role.
- Access to item master records logged in the ERPNext activity log for users outside procurement, sales, or inventory functions.
Detection Strategies
- Compare each user's assigned roles against the endpoints they call and alert when low-privileged accounts query item master data.
- Baseline normal API call volume per user and flag deviations consistent with bulk enumeration of item records.
- Review Frappe audit logs and web server logs for sequential paginated queries against item endpoints.
Monitoring Recommendations
- Enable verbose request logging on the Frappe web tier and forward logs to a central SIEM for correlation with user role assignments.
- Monitor for spikes in GET requests to /api/resource/Item and related item child-table endpoints.
- Track newly created low-privileged accounts that immediately query item master data after first login.
How to Mitigate CVE-2026-109656
Immediate Actions Required
- Upgrade Frappe ERPNext to version 15.118.2 or later on the 15.x branch.
- Upgrade Frappe ERPNext to version 16.30.0 or later on the 16.x branch.
- Audit existing user accounts and remove inactive or unneeded low-privileged users.
- Review access logs since the earliest vulnerable deployment date to identify unauthorized item data reads.
Patch Information
The maintainers released fixes in Frappe ERPNext 15.118.2 and 16.30.0. Upgrade instructions and the full advisory are available at the GitHub Security Advisory GHSA-4j82-w8f7-hqqp.
Workarounds
- Restrict network access to the ERPNext application to trusted users and VPN networks while patching is scheduled.
- Disable self-service account registration to prevent attackers from obtaining the required low-privileged credentials.
- Enforce strong password and multi-factor authentication policies to limit account compromise that could be chained with this flaw.
# Upgrade ERPNext using the bench CLI
bench update --reset
bench --site <site-name> migrate
bench --site <site-name> list-apps
# Confirm erpnext >= 15.118.2 or >= 16.30.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
