CVE-2026-109645

Executive Summary

CVE-2026-109645 is a missing authorization vulnerability (CWE-862) affecting Frappe ERPNext, an open-source Enterprise Resource Planning platform. The flaw exists in certain unspecified endpoints that do not enforce proper permission checks, allowing any authenticated user to create records and modify data beyond their assigned role. Organizations running ERPNext versions prior to 15.119.0 or 16.x prior to 16.31.0 are affected, and exploitation requires only a valid low-privileged account — no special network position or user interaction is needed.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862), which occurs when a system fails to perform an authorization check before allowing access to a resource or operation. In the context of ERPNext, this means that certain HTTP endpoints fail to validate whether the authenticated user's assigned role grants permission to perform the requested action. According to the NVD description, these endpoints "fail to enforce proper permission checks," enabling authenticated attackers to "create records and modify data beyond their permitted role."

ERPNext uses a role-based access control (RBAC) model where users are assigned roles (e.g., Sales User, Accounts User, System Manager) that determine which DocTypes and operations they may access. The vulnerability manifests when an endpoint bypasses this role-based enforcement — likely because the endpoint's handler omits the permission validation layer that should normally be applied. The result is that a low-privileged authenticated user can perform write operations (record creation and data modification) that should require elevated privileges.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates the following characteristics:

• Attack Vector (Network): The vulnerable endpoints are reachable over the network.
• Attack Complexity (Low): No special conditions or race conditions are required to trigger the flaw.
• Privileges Required (Low): The attacker must possess a valid authenticated session but needs no administrative rights.
• User Interaction (None): No action from a legitimate user is needed to trigger exploitation.
• Scope (Unchanged): The impact is confined to the vulnerable ERPNext application context.
• Confidentiality Impact (None): The CVE description focuses on record creation and data modification, not data disclosure.
• Integrity Impact (High): Attackers can create records and modify data beyond their permitted role, constituting a serious integrity breach.
• Availability Impact (None): No denial-of-service condition is described.

The base score of 6.5 (Medium severity) reflects the significant integrity impact offset by the requirement for prior authentication and the absence of confidentiality or availability impact. However, in an ERP context, unauthorized data modification can have outsized business consequences — including financial record tampering, inventory manipulation, and fraudulent transaction creation.

The NVD description does not specify which endpoints are vulnerable. No public proof-of-concept, Nuclei template, or exploit code is available, and no patch advisory from Frappe has been independently verified in the provided data. The precise endpoint paths, parameter names, and code-level mechanism remain undisclosed in public sources, so the analysis is necessarily limited to the vulnerability class.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862, Missing Authorization) and the factual statements in the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies an internet-exposed or internally accessible ERPNext instance. ERPNext deployments are often exposed on standard web ports (80/443) and frequently identifiable via HTTP response headers, page titles, or static asset fingerprints. The attacker enumerates the instance version to confirm it falls within the affected range (< 15.119.0 or 16.x < 16.31.0). Shodan dorks such as http.title:"ERPNext" or http.html:"erpnext" can be used for broad target discovery.

Step 2 — Authentication: The attacker must first obtain a valid authenticated session. This could be accomplished through legitimate account provisioning (e.g., self-registration if enabled, a low-privileged employee account, or a compromised credential). Since the CVSS vector specifies PR:L (Privileges Required: Low), any valid non-administrative account is sufficient. No user interaction from a privileged user is required.

Step 3 — Triggering the Flaw: The attacker identifies the vulnerable endpoints — those that fail to enforce permission checks. As stated in the NVD description, these endpoints allow the authenticated user to create records and modify data beyond their permitted role. The attacker crafts direct HTTP requests to these endpoints, bypassing intended role-based access restrictions. Because the endpoints omit proper authorization enforcement, the requests succeed despite the user's role lacking the necessary permissions.

Step 4 — Execution and Impact: The attacker successfully creates records or modifies existing data within the ERPNext system that their role should not permit. Depending on which endpoints are affected (not specified in the available data), this could include manipulation of business records, inventory, financial entries, customer data, or other ERP objects. The integrity impact is rated High, while confidentiality and availability are unaffected per the CVSS vector.

Note: No public exploit code, PoC repository, or Nuclei template has been published for this CVE as of the available intelligence. The absence of a demonstrated real-world attack chain is based solely on the vulnerability class and the factual NVD description.

Impact Assessment

The business impact of CVE-2026-109645 is significant for organizations relying on ERPNext for core business operations. Because the flaw allows authenticated users to exceed their authorized role boundaries, the primary risk is data integrity compromise:

• Financial Record Tampering: If the vulnerable endpoints include financial or accounting DocTypes, a low-privileged user could insert or alter financial entries, potentially enabling fraud or concealing unauthorized transactions.
• Inventory and Supply Chain Manipulation: ERP systems track physical goods; unauthorized record creation or modification could disrupt inventory accuracy, order management, or procurement workflows.
• Regulatory and Compliance Exposure: Unauthorized data modification in an ERP system may violate SOX, GDPR, or other regulatory frameworks requiring strict access controls and audit integrity.
• Trust Erosion: ERP systems are systems of record. Unauthorized modifications undermine confidence in data accuracy across the organization.

The CVSS 3.1 base score of 6.5 (Medium) reflects a High Integrity (I:H) impact with no Confidentiality (C:N) or Availability (A:N) impact, under a Scope:Unchanged (S:U) assumption. The attack is network-reachable (AV:N), requires low privileges (PR:L), has low complexity (AC:L), and needs no user interaction (UI:N). While the score sits in the Medium range, the operational reality of ERP data tampering can elevate the effective business risk considerably.

The blast radius depends on which endpoints are affected and what DocTypes or data objects they expose. Because the description does not enumerate specific endpoints, the full scope of modifiable records cannot be determined from available intelligence alone. Affected organizations should assume that any data object writable through an improperly authorized endpoint is at risk.

No CISA KEV listing and no known in-the-wild exploitation have been reported.

Detection Guidance

Sigma Rule

title: ERPNext Unauthorized Record Creation or Modification via Missing Authorization
id: 7e3a9c1f-4b2d-4f8a-9c6e-1d2e3f4a5b6c
status: experimental
description: Detects attempts to create or modify ERPNext records through endpoints that fail to enforce role-based permission checks (CVE-2026-109645).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109645
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.initial_access
logsource:
  category: webserver
  product: erpnext
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_uri:
    cs-uri-stem|contains:
      - '/api/resource/'
      - '/api/method/'
  selection_status:
    sc-status:
      - 200
      - 201
  filter_legit:
    cs-username|contains:
      - 'Administrator'
  condition: selection_method and selection_uri and selection_status and not filter_legit
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate authorized users performing standard record operations
  - Automated integrations using service accounts
level: medium

YARA Rule

rule CVE_2026_109645_ERPNext_Missing_Authorization
{
    meta:
        description = "Detects ERPNext application artifacts potentially related to CVE-2026-109645 missing authorization flaw"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109645"
        severity = "medium"

    strings:
        $erp1 = "erpnext" nocase
        $erp2 = "frappe" nocase
        $ver15 = "15.119.0" ascii
        $ver16 = "16.31.0" ascii
        $api1 = "/api/resource/" ascii
        $api2 = "/api/method/" ascii
        $perm1 = "permission" nocase
        $perm2 = "has_permission" nocase

    condition:
        (uint16(0) == 0x3C3F or uint32(0) == 0x464C457F or true) and
        (($erp1 or $erp2) and any of ($api*) and any of ($perm*)) and
        not ($ver15 or $ver16)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109645 ERPNext Missing Authorization - Unauthorized Record Creation/Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/resource/"; http.header; content:"Cookie"; nocase; sid:2026109645; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-109645, updated_at 2026_01_01; classification:attempted-user; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109645;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
   http.method in ("POST", "PUT", "PATCH") and
   http.request.method in ("POST", "PUT", "PATCH") and
   wildcard(http.request.uri, "/api/resource/*") and
   http.response.status_code in (200, 201) and
   user.name != "Administrator"]

Splunk SPL Query

index=web OR index=erpnext
| search (method=POST OR method=PUT OR method=PATCH)
| search uri_path="/api/resource/*" OR uri_path="/api/method/*"
| search status=200 OR status=201
| where user!="Administrator"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, method, status
| where count > 5
| sort - count
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| rename src_ip as "Source IP", user as "Username", uri_path as "Request Path", method as "HTTP Method", status as "Status Code", count as "Request Count"

Wazuh OSSEC Rule

<group name="web,erpnext,CVE-2026-109645,">
  <rule id="1096450" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST|PUT|PATCH</field>
    <field name="http.url" type="pcre2">/api/(resource|method)/</field>
    <field name="http.status">200|201</field>
    <description>CVE-2026-109645: ERPNext potential unauthorized record creation/modification attempt via missing authorization endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109645,attack_initial_access,</group>
  </rule>

  <rule id="1096451" level="12">
    <if_sid>1096450</if_sid>
    <field name="user.name" negate="yes">Administrator</field>
    <description>CVE-2026-109645: ERPNext non-admin user performing write operation on HTTP 2xx - possible exploitation</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_109645,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory URL, patch commit, or workaround has been confirmed in the available data. The version boundaries stated in the NVD description (< 15.119.0 and 16.x < 16.31.0) imply that fixes ship in 15.119.0 and 16.31.0, but this has not been independently verified against a vendor advisory.

1) Immediate Mitigations

• Restrict network access to the ERPNext web interface and API endpoints to trusted networks or VPN-only access. Do not expose ERPNext directly to the public internet unless absolutely required.
• Enforce strict role assignments: audit all user accounts and ensure the principle of least privilege is applied. Remove unnecessary roles from non-administrative accounts.
• Enable and review ERPNext audit logs for record creation and modification events, focusing on actions performed by low-privileged users.
• Deploy the detection rules in this report (Sigma, Suricata, Elastic, Splunk, Wazuh) to monitor for anomalous write operations via /api/resource/ and /api/method/ endpoints.
• If feasible, implement a reverse proxy or API gateway that enforces additional authorization checks on write operations before they reach the ERPNext application layer.

2) Patch / Upgrade Steps

• Monitor the official Frappe/ERPNext release channels for version 15.119.0 and 16.31.0. These version boundaries, derived from the NVD description, represent the earliest versions expected to include the fix.
• Once a patched release is available and validated, upgrade all affected ERPNext instances. Follow the official ERPNext upgrade procedure for your deployment method (bench-based source install, Docker, or Frappe Cloud).
• After upgrading, verify that the version number matches or exceeds the fixed boundary and re-test the previously vulnerable endpoints for proper permission enforcement.
• If a vendor advisory becomes available, follow its specific remediation steps in preference to generic guidance here.

3) Long-Term Hardening

• Implement role-based access control reviews on a recurring schedule. Ensure that every endpoint handling write operations performs an explicit permission check against the user's assigned roles.
• Adopt a secure software development lifecycle (SSDLC) practice that includes mandatory authorization testing for all new endpoints and API methods.
• Integrate automated security testing (SAST/DAST) into CI/CD pipelines to detect missing authorization checks before deployment.
• Maintain a comprehensive logging and monitoring posture with alerting on privilege boundary violations.
• Subscribe to Frappe/ERPNext security advisories and CVE feeds to ensure timely awareness of future vulnerabilities.
• Consider Web Application Firewall (WAF) rules that flag or block write requests to API endpoints from users whose session role context does not match the target resource.

References

1. National Vulnerability Database — CVE-2026-109645: https://nvd.nist.gov/vuln/detail/CVE-2026-109645
2. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. Frappe ERPNext Official Repository / Release Notes: https://github.com/frappe/erpnext/releases
5. FIRST.org EPSS (score not yet available for this CVE): https://api.first.org/data/v1/epss?cve=CVE-2026-109645

Threat Actor / Exploit-in-the-Wild Status: No CISA KEV listing, no public proof-of-concept, no Nuclei template, and no exploit code have been identified for CVE-2026-109645 as of this report. No known threat actor campaigns have been associated with this CVE in available intelligence sources.