Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: frappe erpnext 15.121.3, 16.35.0 Clear all filters
TI-2026-71388 CVE-2026-109629 · GHSA-vjh8-mjr2-jr8r

Missing authorization in Frappe ERPNext transactional email endpoint

Priority LOW 23

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the call…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00192 Published 2026-10-12 Fixed in 15.121.3, 16.35.0 CWE-862
TI-2026-71384 CVE-2026-109625 · GHSA-3vxj-8xvc-cgf2

Missing authorization in Frappe ERPNext exposes financial data

Priority LOW 31

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.121.3, 16.35.0 CWE-862
TI-2026-71378 CVE-2026-109616 · GHSA-j4hh-mjqf-2ggm

Missing authorization in Frappe ERPNext lets users modify data

Priority LOW 31

Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00239 Published 2026-10-12 Fixed in 15.121.3, 16.35.0 CWE-862