CVE-2026-109613

Executive Summary

CVE-2026-109613 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. Low-privileged authenticated users can invoke certain endpoints that fail to enforce proper authorization checks on document status modification, allowing them to change data outside their permitted role and bypass role-based access restrictions. Although confidentiality is unaffected, the flaw permits high-integrity impact and low availability impact (CVSS 7.1), making it a serious risk for organizations exposing ERPNext to less-trusted internal or external users.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862). Per the NVD description, "certain endpoints fail to enforce proper authorization checks on document status modification." This means the affected endpoints accept and process a document status modification request from an authenticated session without verifying that the session's role is permitted to perform that status change. In a role-based access control (RBAC) design like ERPNext, document state transitions (for example, moving a record between workflow states such as draft, submitted, approved, or cancelled) are normally gated by role permissions and by server-side authorization checks tied to doctype and document state. Here, that gate is absent or incomplete on the affected endpoints.

Two important properties follow from the description. First, the flaw is post-authentication: the attacker must already hold a valid low-privileged account. Second, the impact is integrity-focused: the attacker is not described as reading data belonging to other users (Confidentiality: None) but as modifying data beyond their permitted role (Integrity: High). The availability impact is Low, consistent with potential disruption of document workflows (for example, records moved into states that block normal processing). The specific endpoint paths, HTTP methods, and parameter names are not provided in the available description, so no implementation-level detail is asserted here. Similarly, no public proof-of-concept, Nuclei template, or exploit code is known.

From the CVSS vector AV:N/AC:L/PR:L/UI:N/S:U, exploitation is network-reachable, requires low attack complexity, requires a low-privileged account, and needs no user interaction. The Scope is Unchanged, so impact remains bounded to the ERPNext application and its data.

No patch evidence is available from any tracked source (patch confidence 0/4). The only version guidance is the NVD statement that fixed releases are 15.121.0 and 16.34.0.

Exploitation Scenarios

Because no public PoC is available, the attack chain below is inferred strictly from the vulnerability class (missing authorization on document status modification). No specific endpoint names, function names, or parameter names are stated because none are given in the source description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed ERPNext instance and determines the deployed version (pre-15.121.0, or 16.x pre-16.34.0). Public search engines and fingerprinting tools (for example, Shodan queries such as http.title:"ERPNext" or favicon hashing) can reveal candidate hosts. The attacker then needs a low-privileged account. In many organizations this is easy: ERPNext commonly hosts many limited-role users (employees, portal users, vendors, or self-registered accounts), and some deployments expose a portal or signup flow. Phishing, credential stuffing, or abuse of a legitimately issued account can supply the low-privileged session.

2. Triggering the flaw. Using the authenticated low-privileged session, the attacker issues requests to the affected endpoints that modify document status. Because those endpoints do not enforce the authorization check, the request is processed even though the session's role does not permit that document's status modification. This is the core of CWE-862: the endpoint performs the action based on the caller being authenticated, without independently confirming that the caller is authorized for that specific operation.

3. Execution method. At the vulnerability-class level, the attacker sends a crafted status-modification request (for example, an HTTP request carrying a document identifier and a target status value) to the affected endpoint. The server accepts it and applies the state change. No memory corruption, injection payload, or file-write primitive is involved; the "exploit" is simply an unauthorized but well-formed application request.

4. Post-exploitation impact. The attacker can move documents into states they should not be able to set. Depending on which document types are affected, this can bypass review and approval workflows, mark items as approved, cancel or reopen records, or otherwise corrupt business data and process state. The integrity impact is High; availability impact is Low. The lack of confidentiality impact means this is primarily a data-integrity and business-logic abuse vector. An attacker could use it to commit fraud (for example, approving a payment, quote, or purchase order) or to disrupt operations by invalidating workflow state.

Impact Assessment

CVSS 3.1 base score is 7.1 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L.

• Attack Vector: Network — exploitation is possible remotely against any reachable instance.
• Attack Complexity: Low — no special conditions or race windows are described.
• Privileges Required: Low — the attacker must hold a valid low-privileged authenticated account.
• User Interaction: None — no victim action is required beyond the attacker's own authenticated session.
• Scope: Unchanged — impact is confined to the ERPNext application.
• Confidentiality: None — the described flaw concerns modification, not disclosure.
• Integrity: High — unauthorized modification of document status and related data.
• Availability: Low — workflow disruption or records in invalid states can degrade service.

Business impact: ERPNext is used for accounting, inventory, HR, manufacturing, procurement, and CRM. Unauthorized status changes can bypass approval controls, corrupt audit trails, and manipulate financially significant records. Because the flaw requires only a low-privileged account, the blast radius is any organization that grants such accounts (employees, portal users, vendors) on a vulnerable instance. Externally exposed instances are the highest priority, but even internally reachable instances are affected because a low-privileged insider fits the threat model exactly.

Detection Guidance

Sigma Rule

title: ERPNext Unauthorized Document Status Modification (CVE-2026-109613)
id: 7d3b1c2e-4f5a-4a9b-9c60-1e2f3a4b5c6d
status: experimental
description: Detects low-privileged users modifying ERPNext document status via endpoints lacking authorization checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109613
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: erpnext
detection:
  selection:
    event_action|contains:
      - 'document_status_change'
      - 'status_update'
      - 'submit'
      - 'cancel'
  filter_privileged:
    user_role:
      - 'System Manager'
      - 'Administrator'
  condition: selection and not filter_privileged
falsepositives:
  - Legitimate workflow actions by authorized roles not captured in the role field.
level: high
tags:
  - attack.t1190
  - cve.2026.109613

YARA Rule

rule CVE_2026_109613_ERPNext_Missing_Authz_Indicator
{
    meta:
        description = "Heuristic indicator for ERPNext instances affected by CVE-2026-109613 (missing authorization on document status modification)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109613"
        date = "2026-01-01"
        cve = "CVE-2026-109613"
    strings:
        $ver15 = /15\.(1[01][0-9]|120)\./ ascii
        $ver16 = /16\.(1[0-9]|2[0-9]|3[0-3])\./ ascii
        $marker1 = "ERPNext" ascii nocase
        $marker2 = "document_status" ascii nocase
    condition:
        uint32(0) != 0x7f454c46 and $marker1 and ($ver15 or $ver16)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109613 ERPNext Possible Unauthorized Document Status Modification"; flow:established,to_server; http.method; content:"POST"; http.header; content:"Cookie"; http.uri; content:"erpnext"; http.request_body; content:"status"; nocase; classtype:attempted-user; reference:cve,2026-109613; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109613; sid:2026109613; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ any where event.action in ("document_status_change","status_update","submit","cancel")
        and not user.roles in ("System Manager","Administrator") ]

Splunk SPL Query

index=erpnext sourcetype=erpnext:audit (action="document_status_change" OR action="status_update" OR action="submit" OR action="cancel")
| where NOT match(role, "(?i)(System Manager|Administrator)")
| stats count min(_time) as first_seen max(_time) as last_seen values(role) as roles values(doctype) as doctype by user, src_ip, action
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="erpnext,web,appsec,">
  <rule id="109613" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">document_status_change|status_update|submit|cancel</field>
    <field name="role" negate="yes">System Manager</field>
    <description>CVE-2026-109613: Low-privileged ERPNext user performed a document status modification (possible missing authorization abuse).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109613,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict network exposure of ERPNext: place instances behind VPN or an authenticated reverse proxy; do not expose admin or portal interfaces to the public internet.
• Enforce least privilege: audit accounts and remove unnecessary low-privileged or portal accounts. Where feasible, temporarily limit creation of new low-privileged users.
• Apply reverse-proxy or WAF rules to block unexpected document status modification requests from roles not normally permitted to perform them, based on your environment's baseline.
• Increase monitoring of audit logs for status changes performed by non-privileged roles (see detection rules above) and alert in real time.

2. Patch / upgrade steps:

• Per the NVD description, the fixed releases are ERPNext 15.121.0 and 16.34.0. Upgrade to 15.121.0 (or later in the 15.x line) or 16.34.0 (or later in the 16.x line) as soon as testing allows.
• Validate the upgrade in a staging environment and confirm that role-based status-change restrictions are enforced after upgrading.
• Because no vendor-published patch reference is available from tracked sources, verify the fixed versions against the vendor's official release notes before deployment.

3. Long-term hardening:

• Enforce server-side authorization checks on every state-changing endpoint, not just at the UI or routing layer. Adopt a deny-by-default authorization model for document status transitions.
• Add automated tests that assert unauthorized roles receive a denial when attempting status modifications.
• Maintain a vulnerability management process that tracks ERPNext releases and subscribes to vendor security advisories.
• Log and monitor all status-change events with the acting user, role, doctype, and source IP, and retain logs for forensic review.

References

• NVD — CVE-2026-109613: https://nvd.nist.gov/vuln/detail/CVE-2026-109613
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Frappe ERPNext official site and release notes (verify fixed versions 15.121.0 / 16.34.0): https://erpnext.com
• FIRST EPSS (score not yet assigned for this CVE at time of writing): https://www.first.org/epss/

No CISA KEV listing, no known threat actor campaign, and no exploit-in-the-wild evidence were reported for CVE-2026-109613 at the time of writing. No public proof-of-concept or Nuclei template is known.