Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Release: frappe erpnext 15.121.0, 16.34.0 Clear all filters
TI-2026-71389 CVE-2026-109630 · GHSA-6whq-32jc-qmhx

Missing authorization in Frappe ERPNext endpoints lets users read extra data

Priority LOW 23

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00204 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71387 CVE-2026-109628 · GHSA-2wrp-6pff-h89c

Unauthorized status modification in Frappe ERPNext via missing authorization

Priority LOW 31

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71381 CVE-2026-109622 · GHSA-83m8-hj46-hfq9

Missing authorization in Frappe ERPNext lets users modify data

Priority LOW 23

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00192 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71379 CVE-2026-109617 · GHSA-9964-cw4f-c96r

Missing authorization in Frappe ERPNext record creation endpoints

Priority LOW 31

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00222 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71377 CVE-2026-109615 · GHSA-8wwp-crfw-r69p

Missing authorization in Frappe ERPNext document creation endpoints

Priority LOW 31

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00247 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71375 CVE-2026-109613 · GHSA-mpfp-cmm2-68pc

Missing authorization in Frappe ERPNext allows status changes

Priority LOW 31

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00272 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-862
TI-2026-71370 CVE-2026-109608 · GHSA-59gg-p7mc-h3g6

SQL injection in Frappe ERPNext endpoints lets users read data

Priority LOW 39

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00253 Published 2026-10-12 Fixed in 15.121.0, 16.34.0 CWE-89