CVE-2026-109665

Executive Summary

CVE-2026-109665 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions before 15.108.0 and 16.x before 16.18.0. The affected endpoints do not enforce proper permission checks, so any authenticated low-privileged user can invoke them to deactivate master records and modify data outside their authorized role. The impact is integrity-only and scoped (CVSS 4.3), but in an ERP context the deactivation of master data can disrupt core business processes such as accounting, inventory, and procurement.

Technical Analysis

The vulnerability class is missing authorization — specifically CWE-862, "Missing Authorization." The NVD description states that certain ERPNext endpoints fail to enforce proper permission checks. In the Frappe/ERPNext backend model, endpoints are exposed through the framework's API routing layer; the root cause here is that the affected handlers authenticate the caller but do not validate role-based access control before performing a privileged action.

The privileged action described is deactivation of master records. Master records in ERPNext are foundational documents (for example, customers, suppliers, items, warehouses, accounts, and similar entities) that other transactions reference. "Deactivation" is a state change (typically setting a document's enabled/disabled status) rather than deletion. Because the action is a state mutation, it is a write operation governed by ERPNext's permission model. When an endpoint omits the permission check, the authorization decision degenerates to a mere authentication check: any valid session — regardless of assigned roles — is sufficient to perform the mutation.

Two technical attributes are important:

1. Authentication is still required. The CVSS vector PR:L (Privileges Required: Low) confirms the attacker needs a valid low-privileged account. This is not an unauthenticated flaw.
2. Integrity-only, no confidentiality or availability subscore. The vector components C:N and A:N indicate no direct loss of confidentiality and no direct loss of availability. The I:L component indicates a limited integrity impact — consistent with tampering that alters record state without destroying the application's own availability.

No specific endpoint paths, function names, or parameter names are provided in the NVD description or CNA title. Consistent with the strict accuracy rules for this report, no such identifiers are asserted here. The mechanics described above are derived strictly from the vulnerability class and the stated behavior (endpoint-level permission-check omission enabling master-record deactivation by low-privileged authenticated users).

The absence of any CVSS subscore for confidentiality means the flaw does not expose data to the attacker; the concern is purely that data can be changed by the wrong party. Under the CVSS 3.1 framework this yields an overall base score of 4.3 (Medium).

Exploitation Scenarios

The attack chain below is inferred from the vulnerability class (missing authorization on authenticated endpoints) and the behavior described by NVD. No public PoC, exploit code, or Nuclei template exists for this CVE, and none is fabricated here.

1. Reconnaissance / target identification. The attacker identifies an exposed ERPNext deployment. Because ERPNext is a web application, identification can be performed by inspecting HTTP responses, page titles, and application fingerprints. The attacker then obtains credentials for a valid but low-privileged account — for example, through a standard account issuance process, a shared low-privilege credential, or any pre-existing foothold that yields an authenticated session. The flaw requires only "Low"-level privileges per the CVSS vector, so no administrative access is needed.

2. Triggering the flaw class. With an authenticated session established, the attacker locates endpoints that perform master-record state changes but fail to run permission checks. Because the vulnerability class is missing authorization, the request succeeds even though the account's roles should prohibit the action. The key behavior to note is authentication without authorization enforcement: the server accepts the request on the basis of a valid session, not on the basis of a valid permission grant.

3. Execution method (vulnerability-class level). The attacker issues requests to the affected endpoints to deactivate master records. No specific payload structure, HTTP method, API path, or parameter name can be asserted from the available data. At the class level, the operation is an authenticated state-change request that the server processes despite the caller lacking the required role.

4. Post-exploitation impact. Deactivated master records cascade into dependent workflows. Transactions that reference a deactivated master entity may fail validation, be blocked, or behave incorrectly. Because this is an integrity mutation rather than data theft, the attacker's objective is disruption or manipulation of business state rather than exfiltration. The A:N subscore indicates no direct availability impact to the application itself; nonetheless, downstream business-process disruption is the principal consequence.

No public exploit exists, so no specific observed attack chain, campaign, or in-the-wild activity can be attributed to this CVE.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. Subscore interpretation:

• AV:N (Network) — the vulnerable endpoints are reachable over the network; no local access is required.
• AC:L (Low) — no special conditions or race windows are needed; the attack is straightforward once an authenticated session exists.
• PR:L (Low) — the attacker must possess a valid low-privileged account.
• UI:N (None) — no user interaction beyond the attacker's own session is required.
• S:U (Unchanged) — the impact is confined to the vulnerable component; no scope change is scored.
• C:N / I:L / A:N — no confidentiality impact, limited integrity impact, no availability impact.

Business impact. ERPNext is a full ERP platform. Master records underpin accounting, inventory, procurement, sales, and manufacturing workflows. Unauthorized deactivation of these records can silently corrupt or block dependent processes: invoices may fail to post, stock movements may be rejected, or procurement flows may stall. Because the change is a state flag rather than a deletion, it may persist undetected until a downstream transaction fails.

Blast radius. Any organization running an affected ERPNext version with a multi-user deployment and low-privilege accounts is exposed. Cloud-hosted and internet-facing instances carry the highest exposure given AV:N. The scope is bounded by authentication and by the integrity-only nature of the impact (S:U, C:N, A:N), which keeps the base score at Medium rather than High or Critical.

Detection Guidance

Detection for this CVE must focus on authorization anomalies: authenticated sessions performing master-record state changes that are inconsistent with their assigned roles. Because no endpoint names are published, detections should be behavioral and generic to ERPNext state-change operations.

Sigma Rule

title: ERPNext Low-Privileged Master Record Deactivation Attempt (CVE-2026-109665)
id: 7c1e2a44-9b3f-4d21-8e77-0a5c9f21d6b0
status: experimental
description: Detects authenticated requests attempting to deactivate master records in ERPNext, consistent with CWE-862 missing authorization (CVE-2026-109665).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109665
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: erpnext
detection:
  selection_method:
    cs-method:
      - 'POST'
      - 'PUT'
      - 'PATCH'
  selection_keywords:
    cs-uri-query|contains:
      - 'enabled'
      - 'disabled'
      - 'deactivate'
  selection_status:
    sc-status: 200
  filter_admin:
    cs-username|startswith:
      - 'admin'
      - 'Administrator'
  condition: selection_method and selection_keywords and selection_status and not filter_admin
falsepositives:
  - Legitimate administrative deactivation of master records
  - Batch maintenance jobs executed by authorized accounts
level: medium
tags:
  - attack.t1562
  - cwe.862

YARA Rule

rule CVE_2026_109665_ERPNext_Missing_Auth_Master_Deactivation
{
    meta:
        description = "Detects ERPNext requests targeting master-record deactivation state changes consistent with CVE-2026-109665 (CWE-862)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109665"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $erp = "erpnext" nocase
        $m1 = "deactivate" nocase
        $m2 = "enabled" nocase
        $m3 = "is_active" nocase
        $a1 = "Authorization: Bearer"
        $a2 = "session_id"
    condition:
        $erp and $a1 or $a2 and any of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109665 ERPNext Unauthorized Master Record Deactivation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"erpnext"; nocase; http.request_body; content:"deactivate"; nocase; classtype:attempted-admin; reference:cve,2026-109665; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-109665; sid:2026109665; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where event.category == "authentication" and event.outcome == "success"]
  [http where http.request.method in ("POST", "PUT", "PATCH") and
   url.path like~ "*erpnext*" and
   (url.query like~ "*deactivate*" or url.query like~ "*enabled*") and
   http.response.status_code == 200 and
   not user.roles like~ "*System Manager*"]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_erpnext=if(like(lower(uri),"%erpnext%"),1,0)
| eval is_state_change=if(match(lower(uri),"(deactivate|enabled|disable)"),1,0)
| where is_erpnext=1 AND is_state_change=1 AND status=200
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by clientip, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="erpnext,web,cve-2026-109665,">
  <rule id="109665" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">erpnext</field>
    <field name="method">POST|PUT|PATCH</field>
    <field name="url">deactivate|enabled|disable</field>
    <field name="status">200</field>
    <description>CVE-2026-109665: Possible unauthorized master record deactivation attempt in ERPNext</description>
    <mitre>
      <id>T1562</id>
    </mitre>
    <group>cwe_862,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description references fixed versions (15.108.0 and 16.18.0), but no vendor advisory, commit, or patch artifact has been confirmed by the tracked sources. Treat the fix version as the vendor-stated target, not as verified mitigation.

1. Immediate mitigations.

   • Reduce the number of low-privileged authenticated accounts and audit the roles assigned to them; the flaw requires only PR:L.
   • Enforce network segmentation so ERPNext administrative and API surfaces are not internet-exposed (AV:N).
   • Apply outbound/inbound filtering or a reverse proxy rule to restrict access to write endpoints to trusted networks only.
   • Monitor for the behavioral indicators described in the Detection Guidance section, since no vulnerability-specific signature is available.

2. Patch/upgrade steps.

   • Upgrade to ERPNext 15.108.0 or 16.18.0 (or later) as stated in the NVD description.
   • Verify the upgrade against the vendor's release notes before relying on it, because patch confidence is currently unconfirmed.
   • After upgrade, re-test the affected endpoint behavior with a low-privileged account to confirm the permission check is enforced.

3. Long-term hardening.

   • Implement server-side authorization checks at the framework level so that every state-changing endpoint validates role permissions, not only authentication.
   • Adopt role-based access control reviews and least-privilege principles for ERP accounts.
   • Add automated regression tests asserting that low-privileged roles cannot perform master-data mutations.
   • Deploy integrity monitoring on master records to detect unexpected deactivation events.

References

• NVD — CVE-2026-109665: https://nvd.nist.gov/vuln/detail/CVE-2026-109665
• CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1562 (Impair Defenses): https://attack.mitre.org/techniques/T1562/
• CVSS 3.1 Specification (FIRST.org): https://www.first.org/cvss/v3.1/specification-document
• Frappe ERPNext official project / release notes: https://github.com/frappe/erpnext

No CISA KEV listing, threat actor campaign, or exploit-in-the-wild evidence is associated with CVE-2026-109665 at the time of writing.