Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: frappe erpnext 15.111.0, 16.22.0 Clear all filters
TI-2026-71426 CVE-2026-109667 · GHSA-f3v4-m95v-25ch

Privilege escalation in Frappe ERPNext via record creation

Priority LOW 39

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00246 Published 2026-10-12 Fixed in 15.111.0, 16.22.0 CWE-269
TI-2026-71402 CVE-2026-109643 · GHSA-2qh2-rcwf-mjf7

Missing authorization in Frappe ERPNext exposes project data

Priority LOW 31

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00258 Published 2026-10-12 Fixed in 15.111.0, 16.22.0 CWE-862