CVE-2026-109655

Executive Summary

CVE-2026-109655 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions before 15.115.0 and 16.x before 16.26.0. Certain endpoints fail to enforce proper role-based authorization checks, allowing authenticated low-privileged users to modify inventory records beyond their permitted role. With a CVSS score of 6.5, the primary impact is high integrity loss to inventory data, while confidentiality and availability are unaffected.

Technical Analysis

The vulnerability class here is missing authorization — CWE-862. The NVD description states that "certain endpoints" within Frappe ERPNext do not enforce proper role-based authorization checks. This means that one or more HTTP endpoints that perform write operations against inventory records are reachable by authenticated users who do not hold the role required to perform those operations.

ERPNext is built on the Frappe framework, which uses a role-based permission model. In a correctly implemented flow, sensitive write operations are gated by role or permission checks evaluated server-side before the operation is committed. CWE-862 occurs when such a check is absent: the endpoint is reachable, the request is authenticated (a valid session or API token exists), but no authorization predicate is evaluated — or the evaluated predicate is insufficient — before the record mutation occurs.

The practical consequence is horizontal and vertical privilege boundary erosion. A low-privileged authenticated user (for example, a user whose role permits read-only or limited inventory access) can issue requests that result in inventory record modification. The NVD description does not name the affected endpoints, request parameters, or code paths, so the precise mechanism (e.g., omitted decorator, missing frappe.has_permission equivalent, or role bypass in a controller) cannot be asserted from the source data. What is derivable is the attack surface profile: authenticated, network-reachable, low-complexity, no user interaction required.

Because the flaw is authorization-specific rather than injection or memory-corruption, there is no direct remote code execution component implied. The integrity impact is rated High (I:H) in the CVSS vector, reflecting that record contents can be altered without authorization. Confidentiality is None (C:N) and Availability is None (A:N) per the vector, so the described impact is scoped to unauthorized modification, not data exfiltration or denial of service. Note that this scoring reflects the described vector; downstream data integrity loss in inventory systems can plausibly cascade into business-logic or financial impact not captured by the base score.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-109655. The attack chain below is inferred strictly from the vulnerability class (CWE-862) and the NVD description; no specific endpoint names, function names, or parameter names are asserted because the source data does not provide them.

1. Reconnaissance / target identification. An adversary identifies an internet- or intranet-exposed ERPNext instance. Fingerprinting relies on ERPNext/Frappe framework artifacts (login pages, static assets, response headers, or the distinctive /app interface). The adversary must obtain at least one authenticated low-privileged account. This can be a legitimately provisioned account (employee, contractor, vendor portal user) or one obtained through credential compromise, phishing, or password reuse. Because the vulnerability is post-authentication, the barrier to entry is a valid low-privilege session or API token.

2. Triggering the flaw class. With a valid low-privileged identity, the adversary sends requests to the affected inventory endpoints. Authorization enforcement is missing, so the server processes the request using the caller's authenticated session without verifying that the session's role permits the requested inventory write. The attacker does not need to escalate privileges through an exploit chain; the missing control is simply absent on the affected endpoints.

3. Execution method (vulnerability-class level). The adversary issues write-capable HTTP requests (the same endpoints legitimate privileged users would use to create or update inventory records) using their low-privileged credentials. Because role-based checks are not enforced, the requests succeed. At the class level, this is an access-control bypass via direct request to a privileged function, not a payload-injection or memory-safety issue.

4. Post-exploitation impact. Successful requests modify inventory records — quantities, item data, stock movements, or similar record fields depending on what the affected endpoints govern. The CVSS vector reflects integrity-only impact (I:H). Real-world consequences depend on how the modified records are consumed: financial reconciliation, procurement, supply-chain planning, or downstream reporting. An attacker with this access could falsify stock levels, mask shrinkage, or corrupt operational datasets. No confidentiality loss or availability loss is indicated by the vector.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium): AV:N (network-reachable), AC:L (low complexity), PR:L (low privileges required), UI:N (no user interaction), S:U (unchanged scope), C:N (no confidentiality impact), I:H (high integrity impact), A:N (no availability impact). The defining characteristic is that any authenticated low-privileged user can reliably violate the authorization boundary guarding inventory write operations.

Affected systems are ERPNext deployments running versions below 15.115.0 or 16.x below 16.26.0. ERPNext is widely deployed as an integrated ERP covering inventory, accounting, manufacturing, and CRM; an inventory-integrity compromise therefore sits adjacent to financial and operational systems. Blast radius is bounded by the scope of the affected endpoints (unknown from available data) but includes any inventory records those endpoints govern.

Business impact categories:

• Data integrity: unauthorized modification of inventory records undermines stock accuracy, reorder logic, valuation, and audit trails.
• Fraud and insider-risk enablement: low-privileged insiders or compromised accounts can alter records without the usual role gate, complicating attribution.
• Compliance: ERP data often supports financial reporting; integrity compromise can affect SOX-relevant or audit-relevant processes.
• No direct RCE/exfiltration signal: per the vector, confidentiality and availability are unaffected, so this is not a data-theft or outage vector on its own.

CISA KEV listing: NO. EPSS: not yet scored by FIRST.org. exploitation likelihood cannot be quantified from EPSS at this time; no public exploit or PoC is known.

Detection Guidance

Sigma Rule

title: ERPNext Unauthorized Inventory Record Modification (CVE-2026-109655)
id: 7c1e9f2a-4b6d-4a3e-9c11-0f5d2b8e6a10
status: experimental
description: Detects low-privileged or unexpected users performing inventory modification operations in Frappe ERPNext, consistent with missing authorization checks (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109655
author: valtersit.com
date: 2026/01/01
logsource:
  product: erpnext
  service: audit
detection:
  selection_action:
    action|contains:
      - 'inventory'
      - 'stock'
      - 'material'
  selection_write:
    event_type|contains:
      - 'update'
      - 'create'
      - 'modify'
      - 'submit'
  filter_privileged_roles:
    user_role:
      - 'System Manager'
      - 'Stock Manager'
      - 'Stock User'
      - 'Inventory Manager'
  condition: selection_action and selection_write and not filter_privileged_roles
falsepositives:
  - Legitimate role changes or delegated inventory duties
  - Automated integrations using service accounts with inventory roles
level: high
tags:
  - attack.t1190
  - cwe.862

YARA Rule

rule CVE_2026_109655_ERPNext_Missing_Authz
{
    meta:
        description = "Heuristic detection of ERPNext missing-authorization patterns in inventory endpoints (CVE-2026-109655, CWE-862)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109655"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $erpnext = "erpnext" nocase
        $frappe  = "frappe" nocase
        $inv1    = "inventory" nocase
        $inv2    = "stock_entry" nocase
        $inv3    = "stock_ledger" nocase
        $authz1  = "has_permission" nocase
        $authz2  = "require_roles" nocase
        $authz3  = "role_permission" nocase
        $cve     = "CVE-2026-109655"

    condition:
        (uint16(0) == 0x3C3F or true) and
        $frappe and $erpnext and
        any of ($inv*) and
        (
            $cve or
            not any of ($authz*)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109655 ERPNext Unauthorized Inventory Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"erpnext"; http.uri; content:"inventory"; http.uri; pcre:"/(inventory|stock)/i"; http.header; content:"Cookie"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-user; reference:cve,2026-109655; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109655; sid:2026010956; rev:1;)

alert http any any -> any any (msg:"CVE-2026-109655 ERPNext Low-Privilege Inventory Write Burst"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"erpnext"; http.uri; pcre:"/(stock|inventory|material)/i"; threshold:type threshold, track by_src, count 50, seconds 120; classtype:policy-violation; reference:cve,2026-109655; sid:2026010957; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ http.request where http.request.method == "POST"
      and url.path contains "erpnext"
      and (url.path contains "inventory" or url.path contains "stock") ]
  [ http.request where http.request.method == "POST"
      and url.path contains "erpnext"
      and (url.path contains "inventory" or url.path contains "stock") ]

any where event.category == "web"
  and http.request.method == "POST"
  and url.path : ("*erpnext*inventory*", "*erpnext*stock*", "*erpnext*material*")
  and user.roles : ("*")

Splunk SPL Query

index=web OR index=erpnext sourcetype=access_combined OR sourcetype=erpnext_audit
| search (uri="*inventory*" OR uri="*stock*" OR uri="*material*") method=POST
| eval role=coalesce(user_role, role, "unknown")
| where NOT match(role, "(?i)(System Manager|Stock Manager|Inventory Manager)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as endpoints values(status) as status_codes by src_ip, user, role
| where count >= 5
| convert ctime(first_seen) ctime(last_seen)
| sort - count

index=erpnext sourcetype=erpnext:audit "Modified" OR "Updated" "Stock Entry" OR "Inventory"
| eval permitted=if(match(user_role,"(?i)(Stock Manager|Stock User|Inventory Manager|System Manager)"),"yes","no")
| where permitted="no"
| table _time user user_role doctype record action src_ip
| sort - _time

Wazuh OSSEC Rule

<group name="erpnext,cve-2026-109655,">
  <rule id="202610956" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">erpnext</field>
    <field name="action">inventory_modify</field>
    <field name="user_role" negate="yes">System Manager</field>
    <description>CVE-2026-109655: ERPNext inventory modification by non-privileged user</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_862,access_control,</group>
  </rule>

  <rule id="202610957" level="12" frequency="10" timeframe="120">
    <if_matched_sid>202610956</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-109655: Possible inventory record tampering burst from $(srcip)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_862,access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references fixed versions (15.115.0 and 16.26.0) as the remediation boundary. This guidance is therefore structured around that version statement rather than a verified vendor patch artifact.

1) Immediate mitigations

• Restrict network access to ERPNext management and application endpoints. Place ERPNext behind a VPN, zero-trust proxy, or IP allowlist so inventory write endpoints are not directly reachable by unauthenticated or low-privileged external actors.
• Apply least privilege to all ERPNext roles. Audit role definitions and ensure no low-privileged role has effective write permissions to inventory records unless explicitly required.
• Enforce API and session hygiene: rotate API keys, require MFA where supported, and monitor for anomalous low-privilege write activity (see detection rules above).
• Deploy the Sigma/Suricata/Wazuh detections provided in this report to alert on inventory write operations performed by non-inventory roles.
• Where feasible, add a compensating reverse-proxy authorization layer that validates role context before forwarding inventory write requests to ERPNext.

2) Patch / upgrade steps

• Upgrade to ERPNext 15.115.0 or later on the 15.x line, and to 16.26.0 or later on the 16.x line, per the version statement in the NVD description.
• Because patch confidence is 0/4 and no vendor advisory is tracked, validate the fix in a staging environment before production rollout. Confirm that the previously affected inventory endpoints now enforce role-based authorization by testing with a low-privileged account.
• Subscribers to Frappe's release channels should monitor the official ERPNext/Frappe repositories and changelogs for the corresponding authorization fix.

3) Long-term hardening

• Implement centralized, deny-by-default authorization middleware for all write endpoints and require an explicit permission assertion on every state-changing handler.
• Adopt automated authorization testing (role-matrix tests) in CI/CD so that new or modified endpoints cannot ship without a verified permission check.
• Maintain immutable audit logging for inventory transactions and reconcile against physical/financial records to detect tampering.
• Conduct periodic access reviews for ERPNext users and roles, and enforce separation of duties for inventory and financial modules.
• Track CVE-2026-109655 for EPSS scoring and any CISA KEV addition; revisit priority if exploitation signals emerge.

References

• NVD — CVE-2026-109655: https://nvd.nist.gov/vuln/detail/CVE-2026-109655
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
• Frappe ERPNext project / release notes (monitor for the authorization fix corresponding to 15.115.0 and 16.26.0): https://github.com/frappe/erpnext/releases
• CISA Known Exploited Vulnerabilities Catalog (check for future addition): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, or exploit-in-the-wild evidence is available for CVE-2026-109655 at the time of writing. No threat actor campaign is associated with this CVE in the provided data. EPSS has not yet scored this vulnerability.