CVE-2026-109661

Executive Summary

CVE-2026-109661 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions before 15.116.0 and 16.x before 16.27.0. Certain endpoints fail to enforce proper authorization checks, allowing authenticated attackers with low-privileged accounts to query those endpoints and read financial data beyond their permitted role. With a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), the flaw requires only low-privilege authentication, is remotely reachable, and yields high confidentiality impact with no integrity or availability impact.

Technical Analysis

The vulnerability is an instance of CWE-862: Missing Authorization. In ERPNext, a web-based ERP platform built on the Frappe framework, access control is expected to be enforced through role-based permission checks on server-side endpoints. The NVD description states that "certain endpoints" fail to enforce proper authorization checks. The core issue is therefore that one or more server-side handlers expose financial data without validating whether the requesting user holds the role or permission required to access that data.

The attack surface is the authenticated HTTP API/endpoint layer of ERPNext. Because the flaw is missing authorization rather than injection or memory corruption, exploitation does not require malformed input, payload crafting, or memory manipulation. Instead, the attacker authenticates with a low-privileged account and issues requests to the affected endpoints. The server processes these requests and returns financial data that the account should not be able to see.

The CVSS vector confirms the relevant characteristics:

• AV:N (network reachable) — the endpoint is accessible over the network.
• AC:L (low attack complexity) — no special conditions or race windows are required.
• PR:L (low privileges required) — a valid low-privileged authenticated session suffices.
• UI:N (no user interaction) — no victim must click or approve anything.
• S:U (unchanged scope) — the vulnerable component and the impacted data are within the same security authority.
• C:H (high confidentiality impact) — the exposure is financial data.
• I:N / A:N — no data modification or service disruption is described.

The NVD description does not name the specific endpoints, API paths, functions, or parameters involved. No specific implementation details should be inferred beyond what the description states. The precise set of affected endpoints and the exact financial data objects exposed are not enumerated in the source data. What can be stated with confidence is the vulnerability class: role/permission checks are absent or insufficient on endpoints that read financial records, so the endpoints return data to any authenticated user regardless of that user's permitted role.

Because ERPNext deployments frequently hold general ledger entries, invoices, payment records, customer and vendor financial data, and payroll-adjacent information, the confidentiality impact is material even though the flaw is not directly exploitable for code execution or database writes.

Exploitation Scenarios

The following attack chain is described strictly at the vulnerability-class level because the NVD description does not enumerate endpoint names, function names, or parameters, and no public PoC or exploit code exists for this CVE.

1. Reconnaissance / target identification. The attacker identifies a reachable ERPNext instance, for example via Shodan dorks such as http.title:"ERPNext" or http.html:"erpnext". The attacker confirms the version is below 15.116.0 (for the 15.x line) or below 16.27.0 (for the 16.x line), which is the vulnerable range stated in the NVD description.

2. Credential acquisition for a low-privileged account. The flaw requires authentication at low privilege (PR:L). The attacker obtains a valid low-privileged account through any of the usual means — a legitimate but limited account, a misconfigured self-registration flow, reused credentials, or credential stuffing. No exploitation of this CVE itself is needed to gain the account; the CVE is post-authentication.

3. Triggering the missing authorization check. The attacker, now authenticated as a low-privileged user, issues requests to the endpoints that "fail to enforce proper authorization checks." Because those endpoints do not validate the caller's role or permission against the sensitivity of the financial data, the server returns financial data that the account's role should not permit. This is the essence of CWE-862: the request is well-formed and authenticated, but the authorization decision is absent or insufficient. No specific endpoint path, parameter, or function name is provided in the source data, so none is asserted here.

4. Post-exploitation impact. The attacker collects the returned financial data — the description states the exposure is "financial data." The attacker can repeat the queries to enumerate records and build an offline dataset. Since the CVSS vector shows I:N and A:N, there is no described ability to alter or delete records or to disrupt availability through this flaw. The harm is data disclosure enabling financial reconnaissance, competitive intelligence, fraud targeting, or preparation for follow-on attacks.

No public PoC is available; the attack chain above is inferred from the vulnerability class and the NVD description only. No specific code pattern, endpoint name, or hypothetical function name is provided because the source data does not contain them.

Impact Assessment

The direct impact is unauthorized disclosure of financial data to authenticated low-privileged users. The CVSS v3.1 base score is 6.5 (Medium), driven by high confidentiality impact (C:H) combined with low attack complexity, network reachability, and only low privileges required. Integrity and availability impacts are rated None, and scope is Unchanged, so the flaw does not by itself permit data tampering, privilege escalation to administrative control, or denial of service.

Business impact centers on confidentiality and compliance. Financial records exposed to users outside their permitted role can reveal revenue figures, cost structures, invoice and payment details, customer and vendor relationships, and similar sensitive commercial information. For organizations subject to financial reporting, privacy, or contractual confidentiality obligations, such disclosure can trigger regulatory or audit consequences. The blast radius is every ERPNext deployment in the affected version ranges that exposes the impacted endpoints to authenticated users, with the ceiling determined by how much financial data those endpoints return.

Because the precondition is a valid low-privileged authenticated account, the practical exposure is highest where ERPNext instances allow broad account creation or where many users hold limited accounts. The absence of a public exploit and the absence from CISA KEV mean there is no confirmed in-the-wild exploitation at the time of this report, but the low attack complexity and the value of the exposed data make the flaw attractive for targeted, quiet data collection rather than noisy intrusion.

Detection Guidance

Sigma Rule

title: ERPNext Missing Authorization Financial Data Access (CVE-2026-109661)
id: 9f2c1a44-3b7e-4c2a-9d10-7a6e5b21c001
status: experimental
description: Detects authenticated low-privileged requests to ERPNext endpoints returning financial data, associated with CWE-862 missing authorization in versions before 15.116.0 and 16.x before 16.27.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109661
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: erpnext
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_path:
    cs-uri-stem|contains:
      - '/api/method/'
      - '/api/resource/'
  selection_finance:
    cs-uri-query|contains:
      - 'financial'
      - 'ledger'
      - 'invoice'
      - 'payment'
  filter_admin:
    cs-username|contains:
      - 'Administrator'
      - 'System Manager'
  condition: selection_method and selection_path and selection_finance and not filter_admin
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate finance-role users accessing financial endpoints
  - Automated reporting jobs running under service accounts with finance roles
level: medium
tags:
  - attack.t1213
  - cwe.862
  - cve.2026.109661

YARA Rule

rule CVE_2026_109661_ERPNext_Missing_AuthZ
{
    meta:
        description = "Detects ERPNext artifacts referencing vulnerable version ranges for CVE-2026-109661 (CWE-862 missing authorization)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109661"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $erpnext = "erpnext" ascii nocase
        $frappe  = "frappe" ascii nocase
        $v15     = "15.1" ascii
        $v16     = "16.2" ascii
        $cv      = "CVE-2026-109661" ascii

    condition:
        ($erpnext or $frappe) and ($v15 or $v16 or $cv)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109661 ERPNext Missing Authorization Financial Data Access Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.uri; content:"financial"; nocase; http.user_agent; content:"python-requests"; nocase; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-109661; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109661; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026109661; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where event.category == "network" and
      url.path : "/api/*" and
      url.query : ("*financial*" or "*ledger*" or "*invoice*" or "*payment*") ]
  [ network where event.category == "network" and
      http.response.status_code == 200 and
      url.path : "/api/*" ]

Splunk SPL Query

index=web sourcetype=erpnext_access
| search uri_path="/api/*" (uri_query="*financial*" OR uri_query="*ledger*" OR uri_query="*invoice*" OR uri_query="*payment*")
| eval is_admin=if(match(user, "(?i)(administrator|system manager)"), 1, 0)
| where is_admin=0
| stats count min(_time) as first_seen max(_time) as last_seen values(uri_path) as paths values(uri_query) as queries by src_ip user status
| where count >= 10
| sort - count

Wazuh OSSEC Rule

<group name="erpnext,web,cve-2026-109661,">
  <rule id="2026109" level="8">
    <decoded_as>json</decoded_as>
    <field name="uri_path">/api/</field>
    <field name="uri_query">financial|ledger|invoice|payment</field>
    <description>CVE-2026-109661: Possible ERPNext missing authorization access to financial endpoints</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>

  <rule id="2026110" level="10" frequency="10" timeframe="300">
    <if_matched_sid>2026109</if_matched_sid>
    <same_source_ip />
    <same_field>user</same_field>
    <description>CVE-2026-109661: Repeated ERPNext financial endpoint access by low-privileged user (possible enumeration)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix URL, commit, or advisory was provided, and there is no CISA KEV entry.

1. Immediate mitigations, while no confirmed patch artifact is available:

   • Restrict network exposure of ERPNext so that the API/endpoint layer is reachable only from trusted networks or a VPN, reducing the population of actors that can authenticate.
   • Tighten account provisioning: disable self-registration if enabled, enforce least privilege on all accounts, and audit low-privileged accounts for legitimacy.
   • Add a reverse-proxy or WAF layer that enforces role-appropriate access controls on requests to financial-data endpoints, compensating for the missing application-level authorization check. Because the specific endpoints are not enumerated in the source data, this requires identifying which endpoints return financial data in the deployed instance.
   • Monitor and alert on authenticated access to financial endpoints by users outside finance roles, using the detection content above.
   • Remove or disable accounts that are unused or that do not require access to financial data.

2. Patch/upgrade steps:

   • The NVD description states the vulnerability exists before 15.116.0 and in 16.x before 16.27.0, which implies fixed releases at 15.116.0 and 16.27.0. Because patch confidence is 0/4, verify the fix independently before relying on it: consult the Frappe/ERPNext release notes and security advisories for the exact fixed version, and validate that the version deployed is at or above the fixed release.
   • Take a full backup before upgrading, stage the upgrade in a non-production environment, and confirm after upgrade that the affected endpoints now enforce role checks.
   • Track the NVD entry and the vendor's release notes for an updated, vendor-confirmed fixed version.

3. Long-term hardening:

   • Implement centralized, testable authorization middleware so every endpoint reading financial data performs an explicit role/permission check, and add automated tests that assert low-privileged users receive authorization failures on those endpoints.
   • Adopt a policy of "deny by default" for new endpoints, requiring an explicit permission declaration before an endpoint can serve data.
   • Maintain an inventory of endpoints that touch financial data and review their authorization requirements on a recurring schedule.
   • Enable comprehensive access logging (who accessed which endpoint, with what role, at what time) and feed it to the SIEM for behavioral baselines and anomaly detection.

References

• NVD — CVE-2026-109661: https://nvd.nist.gov/vuln/detail/CVE-2026-109661
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• FIRST EPSS — not yet scored for CVE-2026-109661 (no fabricated value provided)
• CISA Known Exploited Vulnerabilities Catalog — CVE-2026-109661 is not listed (as of this report)
• Frappe / ERPNext project — consult official release notes and security advisories for the vendor-confirmed fixed versions 15.116.0 and 16.27.0

No public PoC, exploit code, Nuclei template, or confirmed exploit-in-the-wild activity was identified in the provided source data. No known threat actor campaign is associated with this CVE in the available information.