CVE-2026-109660

Executive Summary

CVE-2026-109660 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions prior to 15.112.0 and 16.x prior to 16.23.0. Certain HTTP endpoints fail to enforce proper authorization checks on operations that modify production records, allowing an authenticated low-privileged user to alter production data beyond what their assigned role permits. The vulnerability carries a CVSS base score of 6.5 (Medium), with the impact concentrated entirely on integrity (I:H), and affects any organization running an unpatched ERPNext deployment exposed to authenticated users.

Technical Analysis

The root cause is CWE-862: Missing Authorization. The NVD description states that specific endpoints within ERPNext "do not enforce proper authorization checks on operations that modify production records." This means that while the application authenticates the request (the attacker must be a valid, authenticated user), it does not subsequently verify that the requesting user's assigned role grants permission to perform the data-modification operation.

The vulnerability class is a horizontal/vertical privilege boundary failure. In a role-based access control (RBAC) system such as ERPNext's, endpoints that mutate production records should validate that the caller holds the appropriate role or permission level before executing the write. In this case, one or more such endpoints omit that server-side authorization gate. Consequently, the authorization decision defaults to the authentication state rather than the privilege level, so any authenticated user — including one with a minimal role — can invoke the operation.

Key characteristics derived strictly from the available data:

• Precondition: valid authentication as a low-privileged user (PR:L).
• Attack vector: network (AV:N), no user interaction required (UI:N), no special conditions beyond authentication (AC:L).
• Scope: unchanged (S:U) — the vulnerable component and the impacted data reside in the same ERPNext deployment.
• Impact: high to integrity (I:H) on production records; no confidentiality (C:N) or availability (A:N) impact is cited.

The exact endpoint paths and the specific permission bypass mechanism are not disclosed in the NVD description or CNA title. No function names, API routes, or parameter names are provided. Accordingly, this report describes the vulnerability at the class and mechanism level and does not fabricate implementation specifics. ERPNext production records can include documents, stock entries, manufacturing orders, and other operational data. Because the flaw permits modification "beyond what their assigned role permits," the practical effect is that the role-based boundary protecting production data can be circumvented by any authenticated account.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-109660, and no Nuclei template exists. The attack chain below is inferred from the missing-authorization vulnerability class and the facts stated in the NVD description; specific endpoint names are intentionally omitted because they are not disclosed.

1. Reconnaissance / target identification An adversary identifies an internet- or intranet-exposed ERPNext instance within one of the affected version ranges (< 15.112.0 or 16.x < 16.23.0). Exposed ERPNext deployments are discoverable via web fingerprinting of ERPNext/Frappe login pages and application assets. The attacker needs at least one valid low-privileged account, which may be obtained through legitimate provisioning, a weak or default credential, or social means.

2. Triggering the flaw class Once authenticated with a low-privileged role, the attacker identifies endpoints that modify production records but that fail to enforce proper authorization checks. Because the server does not validate the caller's role against the operation being performed, the request is processed regardless of the user's permission level. No privilege escalation to an administrative role is required — the authentication state alone satisfies the endpoint.

3. Execution method The attacker sends requests directly to these endpoints (for example, by interacting with the underlying API rather than through the UI, which may itself enforce client-side role restrictions that the server does not). The request carries the modification the attacker wishes to apply to production records. Since the endpoint performs the write without an authorization check, the operation succeeds beyond the user's assigned permissions. No payload-level exploit primitive (such as injection or memory corruption) is involved; the "exploit" is simply an under-authorized, but valid, API call.

4. Post-exploitation impact The attacker can modify production records — data that the attacker's role should not be able to touch. This enables data integrity attacks against operational and business records. Depending on which records are reachable, consequences may include falsified inventory, altered transactional or operational entries, and corruption of business data used for planning, reporting, or downstream processing. There is no stated confidentiality or availability impact, and no remote code execution is indicated by the vulnerability class.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium): AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

• Attack Vector Network (AV:N) and Attack Complexity Low (AC:L): the flaw can be reached and triggered over the network without specialized conditions.
• Privileges Required Low (PR:L): the attacker must hold an authenticated account, but only a low-privileged one. This materially widens the pool of potential internal abusers and compromised-credential holders.
• User Interaction None (UI:N): no victim action is needed beyond the application processing the request.
• Scope Unchanged (S:U): the impact remains within the ERPNext deployment and its data.
• Confidentiality None (C:N), Availability None (A:N): the vulnerability does not expose or destroy data in the sense scored; the sole impact is Integrity High (I:H).

Business impact: ERPNext is a widely deployed open-source ERP platform handling finance, inventory, manufacturing, HR, and CRM records. Unauthorized modification of production records undermines data trustworthiness, can distort inventory and operational planning, may corrupt financial or compliance reporting, and can trigger downstream process errors. Blast radius scales with how many authenticated users an organization grants and how broadly the affected endpoints are reachable. The low privilege requirement (PR:L) means the weakness applies across the entire authenticated user base, not just administrators. Because there is no public exploit and no CISA KEV listing, mass opportunistic exploitation is unlikely in the short term, but the low complexity and low privilege bar make it attractive for insider misuse and for an attacker who has already obtained any authenticated foothold.

Detection Guidance

No exploit code or public PoC exists, so detections must target the behavioral pattern: authenticated users issuing data-modification requests to endpoints they are not authorized for. Because specific endpoint paths are not disclosed, the following rules generalize to ERPNext/Frappe API write operations and should be tuned with environment-specific endpoint and role baselining.

Sigma Rule

title: Suspected ERPNext Unauthorized Production Record Modification (CVE-2026-109660)
id: 3f9c2a1e-8b74-4d2f-9a6c-erpnext109660
status: experimental
description: Detects authenticated ERPNext/Frappe API requests that modify production records, indicative of missing authorization checks per CVE-2026-109660.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109660
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: frappe
detection:
  selection_method:
    cs-method:
      - POST
      - PUT
      - PATCH
      - DELETE
  selection_path:
    cs-uri-stem|contains:
      - '/api/resource/'
      - '/api/method/'
  selection_modify:
    cs-uri-query|contains:
      - 'update'
      - 'submit'
      - 'cancel'
      - 'amend'
  filter_auth:
    sc-status: 403
  condition: selection_method and selection_path and selection_modify and not filter_auth
falsepositives:
  - Legitimate authorized updates by privileged roles
  - Automated integrations with broad permissions
level: medium

YARA Rule

rule ERPNext_CVE_2026_109660_Authz_Bypass
{
    meta:
        description = "Detects references to ERPNext/Frappe endpoints modifying production records without authorization (CVE-2026-109660)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109660"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $frappe1 = "frappe" ascii nocase
        $erpnext1 = "ERPNext" ascii nocase
        $api1 = "/api/resource/" ascii nocase
        $api2 = "/api/method/" ascii nocase
        $mod1 = "update" ascii nocase
        $mod2 = "submit" ascii nocase
        $mod3 = "cancel" ascii nocase
    condition:
        uint16(0) == 0x5A4D or
        (2 of ($frappe* , $erpnext*) and any of ($api*) and any of ($mod*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109660 Possible ERPNext Unauthorized Production Record Modification"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/resource/"; http.uri; content:"update"; nocase; classtype:attempted-user; reference:cve,2026-109660; sid:2026109660; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ network where http.request.method in ("POST","PUT","PATCH","DELETE")
      and url.path : ("/api/resource/*" or "/api/method/*")
      and http.response.status_code in (200, 201, 204)
      and not user.roles : ("System Manager","Administrator") ]

Splunk SPL Query

index=web sourcetype=frappe_access
| eval method=upper(cs_method)
| where method IN ("POST","PUT","PATCH","DELETE")
| where match(uri_path, "^/api/(resource|method)/")
| where match(lower(uri_path), "update|submit|cancel|amend")
| where status IN (200,201,204)
| stats count values(uri_path) as endpoints by src_ip user
| where count >= 5

Wazuh OSSEC Rule

<group name="erpnext,web,cve-2026-109660,">
  <rule id="109660" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <if_sid>31100</if_sid>
    <match>POST|PUT|PATCH|DELETE</match>
    <regex>/api/(resource|method)/</regex>
    <regex>update|submit|cancel|amend</regex>
    <description>CVE-2026-109660: Possible unauthorized ERPNext production record modification attempt</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version package data is available in the supplied intelligence. The fixed versions cited by the vendor description are 15.112.0 and 16.23.0.

1. Immediate mitigations

• Restrict network reachability of the ERPNext instance to trusted networks; do not expose the application to the public internet where avoidable.
• Enforce least privilege on all accounts: audit existing user roles and remove any unnecessary create/write/submit permissions on production record types.
• Enable comprehensive access logging for API and web requests, capturing authenticated user, source IP, method, path, and response status, and forward logs to a SIEM for monitoring.
• Apply a compensating control at the reverse proxy or WAF layer to block or alert on write operations to record-modifying endpoints originating from users without elevated roles.
• Rotate credentials and review accounts for any signs of compromise or misuse, given that only a low-privileged authenticated account is needed.

2. Patch / upgrade steps

• Upgrade ERPNext to 15.112.0 or later, or to 16.23.0 or later for the 16.x branch, per the vendor description.
• Because no patch artifact has been verified in tracked sources, confirm the fixed version directly from the vendor's official release channel before upgrading.
• After upgrade, retest the affected endpoints with low-privileged accounts to confirm authorization is now enforced.
• Stage the upgrade in a non-production environment first to validate compatibility with customizations.

3. Long-term hardening

• Adopt server-side authorization enforcement as a mandatory review item for every endpoint that mutates data; never rely on client-side role checks.
• Implement automated regression testing that verifies low-privileged roles cannot invoke operations beyond their permissions.
• Enforce strict RBAC with periodic access reviews and separation of duties for production-record modification.
• Maintain an inventory of exposed ERP endpoints and monitor for abnormal modification patterns as part of continuous detection engineering.

References

• NVD — CVE-2026-109660: https://nvd.nist.gov/vuln/detail/CVE-2026-109660
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1565.001 — Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-109660 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Frappe ERPNext official release/security channel: https://github.com/frappe/erpnext

No threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-109660 based on the supplied intelligence. EPSS has not been scored by FIRST.org, and no public PoC, exploit code, or Nuclei template is known.