Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: frappe erpnext 15.115.0, 16.26.0 Clear all filters
TI-2026-71417 CVE-2026-109658 · GHSA-3qvf-g6r6-qxvr

Missing authorization in Frappe ERPNext endpoints exposes data

Priority LOW 31

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.115.0, 16.26.0 CWE-862
TI-2026-71414 CVE-2026-109655 · GHSA-ww46-cv9p-4vxh

Frappe ERPNext inventory endpoints miss authorization checks

Priority LOW 31

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00221 Published 2026-10-12 Fixed in 15.115.0, 16.26.0 CWE-862
TI-2026-71395 CVE-2026-109636 · GHSA-wmx2-rf32-3497

Missing authorization in Frappe ERPNext exposes financial data

Priority LOW 31

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.115.0, 16.26.0 CWE-862