CVE-2026-109650

Executive Summary

CVE-2026-109650 is a missing authorization vulnerability (CWE-862) affecting Frappe ERPNext before version 15.112.0 and 16.x before 16.23.0. Authenticated low-privileged users can send requests to certain endpoints that fail to enforce proper authorization checks, allowing them to read personal data beyond what their assigned role permits. With a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this is a medium-severity confidentiality breach requiring only low-privileged authenticated access, making it exploitable by any valid user account without user interaction.

Technical Analysis

The vulnerability is classified as CWE-862: Missing Authorization. This class of flaw occurs when an application does not perform or incorrectly performs an authorization check when a user attempts to access a resource or perform an action. Unlike CWE-863 (Incorrect Authorization) or CWE-306 (Missing Authentication for Critical Function), CWE-862 specifically means the authorization control is entirely absent at the affected endpoint — the application accepts the request and returns data without verifying whether the requesting user's role or permissions permit that access.

In the context of ERPNext, an open-source ERP platform built on the Frappe framework, "endpoints" refer to HTTP API routes exposed by the application. The NVD description states that "certain endpoints fail to enforce proper authorization checks" and that "authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits." This indicates the flaw is a horizontal or vertical privilege escalation of read access: the user has a valid session and a low-privilege role, but the endpoint does not validate role-based read permissions before returning data.

The attack surface is the web-accessible ERPNext API. Because the CVSS vector is AV:N (network), the vulnerable endpoints are reachable over the network. PR:L (low privileges) confirms exploitation requires only a basic authenticated account. No user interaction (UI:N) and no special conditions (AC:L) are required, meaning any authenticated low-privileged user can trigger the flaw repeatedly. The scope is unchanged (S:U), and the sole impact is high confidentiality loss (C:H) with no integrity or availability impact — consistent with a read-only data exposure vulnerability.

The specific endpoint names, parameter names, and code-level control flow are not disclosed in the NVD description or CNA title provided. No function names, class names, URL paths, or API parameters can be confirmed from the available data. The technical mechanism is therefore described at the vulnerability-class level: an authorization middleware or permission check that should gate access to personal-data-returning endpoints is missing or bypassable for low-privileged roles.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-109650 as of this report. The attack chain below is inferred strictly from the vulnerability class (CWE-862) and the NVD description.

1. Reconnaissance/target identification: An attacker identifies an internet- or intranet-exposed ERPNext instance running an affected version (< 15.112.0 or 16.0.0–16.22.x). This can be done via Shodan searches for ERPNext login portals or by directly probing known ERPNext deployment paths. The attacker must obtain a valid low-privileged account, which in an ERP context may be a standard employee, supplier, or customer portal account — a low barrier in multi-tenant or self-service registration deployments.

2. Triggering the flaw class: Using the authenticated low-privileged session, the attacker sends requests to the affected endpoints. Because the endpoints lack proper authorization checks (CWE-862), the application processes the request without verifying that the user's role permits access to the requested personal data. The attacker does not need to escalate privileges through exploitation — the missing check means normal low-privilege requests to those endpoints return data the role should not see.

3. Payload/execution method at the vulnerability-class level: The execution method is a standard authenticated HTTP request to the vulnerable endpoint. No special payload, injection string, or memory-corruption primitive is involved. The "payload" is simply a valid request issued with a low-privileged session cookie or API token. Any parameter manipulation would only involve specifying identifiers of records the user should not be authorized to read; no specific parameter names are disclosed in the source data.

4. Post-exploitation impact: Successful exploitation yields read access to personal data beyond the attacker's assigned role. In an ERP system, personal data may include employee records, customer contact details, supplier information, or other personally identifiable information (PII) stored in the platform. This enables data harvesting, privacy regulation violations, and reconnaissance for further targeted attacks (e.g., phishing using harvested personal details). There is no integrity or availability impact — the attacker cannot modify or delete data through this flaw.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium). Subscore breakdown: Attack Vector Network (AV:N) — exploitable remotely over the network; Attack Complexity Low (AC:L) — no special conditions; Privileges Required Low (PR:L) — any authenticated low-privileged user; User Interaction None (UI:N) — no victim action needed; Scope Unchanged (S:U) — impact confined to the vulnerable component; Confidentiality High (C:H) — significant personal data exposure; Integrity None (I:N); Availability None (A:N).

Business impact centers on unauthorized disclosure of personal data. Organizations running affected ERPNext versions face regulatory exposure under GDPR, CCPA, and similar privacy regimes because the data exposed is personal data. The blast radius is any ERPNext deployment with self-service, portal, or multi-role user bases where low-privileged accounts are common. Because the flaw requires only a valid low-privilege account, the effective threat actor pool includes malicious insiders, compromised low-privilege accounts, and external attackers who can obtain or register a basic account. The absence of integrity and availability impact limits operational disruption, but the confidentiality loss can enable downstream fraud, targeted phishing, and identity theft.

Detection Guidance

Sigma Rule

title: Potential ERPNext Missing Authorization Personal Data Access (CVE-2026-109650)
id: 6f1a2b3c-4d5e-6f70-8192-a3b4c5d6e7f8
status: experimental
description: Detects repeated authenticated API access attempts against ERPNext endpoints that may indicate exploitation of missing authorization checks allowing low-privileged users to read personal data beyond their role.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109650
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1078
  - cve.2026.109650
logsource:
  category: webserver
  product: erpnext
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - '/api/'
      - '/api/method/'
  selection_status:
    sc-status:
      - 200
      - 201
  filter_privileged:
    cs-username|contains:
      - 'Administrator'
      - 'System Manager'
  condition: selection_method and selection_path and selection_status and not filter_privileged
falsepositives:
  - Legitimate low-privileged users accessing endpoints they are authorized for
  - Automated integrations using service accounts
level: medium

YARA Rule

rule CVE_2026_109650_ERPNext_Missing_Authorization
{
    meta:
        description = "Detects ERPNext server-side artifacts potentially associated with missing authorization vulnerability CVE-2026-109650"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109650"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $erpnext = "erpnext" nocase
        $frappe = "frappe" nocase
        $auth_terms1 = "has_permission" nocase
        $auth_terms2 = "check_permission" nocase
        $auth_terms3 = "frappe.permissions" nocase
        $version15 = "15.112.0"
        $version16 = "16.23.0"

    condition:
        ($erpnext or $frappe) and
        ($auth_terms1 or $auth_terms2 or $auth_terms3) and
        not ($version15 or $version16)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109650 ERPNext Missing Authorization Personal Data Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; http.header; content:"Cookie"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-109650; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109650; sid:2026109650; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where event.category == "network" and
      http.request.method in ("GET", "POST") and
      stringContains(http.request.path, "/api/") and
      http.response.status_code in (200, 201) ]
  [ network where event.category == "network" and
      http.request.method in ("GET", "POST") and
      stringContains(http.request.path, "/api/") and
      http.response.status_code in (200, 201) ]

Splunk SPL Query

index=web sourcetype=erpnext_access
| search uri_path="/api/*" status=200
| stats count values(uri_path) as paths dc(uri_path) as unique_paths by src_ip, user
| where count > 20 AND unique_paths > 5
| sort - count

Wazuh OSSEC Rule

<group name="erpnext,web,cve-2026-109650,">
  <rule id="109650" level="10">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/api/</field>
    <field name="status">200</field>
    <description>CVE-2026-109650: Possible ERPNext missing authorization - low-privileged user accessed API endpoint returning personal data</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_109650,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Restrict network access to affected ERPNext instances so only trusted networks or VPN clients can reach the application. Enforce least privilege on all user accounts and audit role assignments to minimize the number of low-privileged accounts that could be used to exploit the missing authorization checks. Review and harden API endpoint exposure, disabling portal or self-service features that create low-privileged accounts if not required. Monitor web access logs for anomalous authenticated API requests returning HTTP 200 from low-privileged sessions.

2. Patch/upgrade steps: Per the NVD description, upgrade to ERPNext 15.112.0 or 16.23.0, which are the versions that address the missing authorization vulnerability. Because no vendor advisory or patch source is currently tracked in this dataset, verify the availability of these releases directly through the Frappe/ERPNext official channels and test upgrades in a staging environment before production deployment. After upgrading, confirm the affected endpoint authorization behavior with a low-privileged test account.

3. Long-term hardening: Implement centralized role-based access control verification at the API layer, ensuring every endpoint returning personal data enforces an explicit permission check. Adopt regular authorization testing (e.g., automated checks that enumerate endpoints and verify role enforcement) as part of CI/CD. Maintain an up-to-date inventory of ERPNext versions and subscribe to Frappe security advisories. Deploy WAF rules that monitor sequential or anomalous API access patterns from low-privileged sessions. Apply data minimization to reduce the volume of personal data accessible through any single endpoint.

References

• NVD — CVE-2026-109650: https://nvd.nist.gov/vuln/detail/CVE-2026-109650
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Frappe ERPNext official project and security advisories: https://github.com/frappe/erpnext
• Frappe Framework security documentation: https://frappeframework.com/docs
• CISA Known Exploited Vulnerabilities Catalog (not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-109650 in the available data. No public PoC, Nuclei template, or exploit code exists as of this report.