CVE-2026-109667

Executive Summary

CVE-2026-109667 is a privilege escalation vulnerability in Frappe ERPNext affecting versions before 15.111.0 and 16.x before 16.22.0. The flaw resides in a record-creation endpoint that accepts a caller-supplied record type and inserts that record with permission checks disabled, allowing any authenticated user — even one with no operational role — to create privileged accounts and seize full control of the site. With a CVSS base score of 8.8 and a network-reachable, low-privilege attack vector, this represents a critical integrity and confidentiality risk for exposed ERPNext deployments.

Technical Analysis

The vulnerability is classified under CWE-269 (Improper Privilege Management). Per the NVD description, the affected component is a record-creation endpoint that derives the record type from the incoming request and then inserts the record with permission checks disabled. This design accepts attacker-influenced input for a security-sensitive parameter (the record type) and combines it with a deliberately bypassed authorization check, producing a broken access control condition.

The core defect is a missing or bypassed authorization enforcement on a privileged write path. Normally, creating a record of a privileged type — for example, a user or role-bearing object — should require elevated permissions. Here, the endpoint does not bind the permitted record type to the requesting user's privileges, nor does it verify the caller's authorization before insertion. Because permission checks are disabled at the point of insertion, the server-side logic no longer restricts which record types may be created or by whom.

Attack surface characteristics:

• Reachability: Network (AV:N). The endpoint is part of the ERPNext web application and is reachable by any client able to establish an authenticated session.
• Authentication requirement: Low privileges (PR:L). A valid session is required, but no administrative or operational role is necessary. Any authenticated user, including one holding no operational role, qualifies.
• Complexity: Low (AC:L). The attack does not require specialized conditions, race conditions, or significant reconnaissance beyond identifying the endpoint.
• User interaction: None (UI:N). No victim action is required.
• Scope: Unchanged (S:U). The impact is confined to the affected ERPNext site/security authority.

No specific internal function names, class names, route paths, or parameters are provided in the available NVD description, so this analysis deliberately describes the flaw at the vulnerability-class level rather than fabricating implementation details. What is verifiable from the description is the mechanism: caller-controlled record type + disabled permission checks = unauthorized creation of privileged records.

Because the record type is taken from the request, an attacker who can specify a privileged record type effectively instructs the application to mint an object that should be reserved for administrators. The disabling of permission checks removes the last guard that would otherwise block that creation. The result is a direct path from an ordinary authenticated account to a privileged account.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The following attack chain is inferred strictly from the vulnerability class and the NVD description; no specific function names, parameters, or endpoints beyond those in the description are asserted.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed ERPNext instance running an affected version (before 15.111.0, or 16.x before 16.22.0). Public Shodan-style fingerprinting using ERPNext/Frappe indicators can locate candidate hosts. The attacker registers or otherwise obtains any authenticated account — the flaw explicitly requires only authentication, not an operational role.

2. Triggering the flaw. Using the authenticated session, the attacker locates the record-creation endpoint and submits a request in which the record type is set to a privileged type. Because the endpoint takes the record type from the request and inserts the record with permission checks disabled, the server processes the creation without enforcing that the caller is authorized for that record type.

3. Payload / execution method (class level). The attacker supplies a privileged record type in the creation request. The application, having disabled permission checks at insertion, creates the record. Because no public exploit exists, the precise request body and field names are not documented here and must be derived by the defender from the patched endpoint diff. No specific parameter names are invented.

4. Post-exploitation impact. By creating privileged records — explicitly including privileged accounts — the attacker can obtain elevated access and, per the CNA description, take full control of the site. Full control implies the ability to read and modify sensitive business data (Finance, HR, CRM records held in ERPNext), alter application configuration, persist via newly created accounts, and potentially pivot to integrated systems and connected databases.

Impact Assessment

CVSS 3.1 base score: 8.8 (High). The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H drives the assessment:

• Confidentiality: High — full site control exposes all data managed by the ERP, which for ERPNext commonly includes financial, customer, employee, and operational records.
• Integrity: High — an attacker able to create privileged records and accounts can modify or fabricate business data and configuration.
• Availability: High — full control of the site permits destructive actions or disruption of service.
• Exploitability: Attacker needs network access and any authenticated account, with no user interaction and low complexity. This dramatically broadens the pool of potential attackers to include any low-privileged or self-registered user.

Business impact: ERPNext is a full ERP suite; compromise can lead to fraudulent transactions, data exfiltration of regulated information, business email/identity abuse via account takeover within the platform, and lateral movement to connected services. Because the attacker escalates directly to full site control, the blast radius is effectively the entire ERPNext deployment and everything it integrates with.

EPSS: Not yet scored by FIRST.org. CISA KEV: Not listed. As of this writing there is no evidence of exploitation in the wild; however, the low barrier to entry (authenticated, low complexity, no user interaction) makes weaponization likely once the endpoint details circulate.

Detection Guidance

Sigma Rule

title: ERPNext Privilege Escalation via Record-Creation Endpoint
id: 8f2c1a44-1096-4f7e-9c1a-20261096670a
status: experimental
description: Detects creation of privileged records through the ERPNext record-creation endpoint by users lacking an operational role (CVE-2026-109667).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109667
author: valtersit.com
date: 2026/01/01
logsource:
  product: erpnext
  service: web
detection:
  selection_endpoint:
    http.method: 'POST'
    http.url|contains: 'frappe'
  selection_status:
    http.status_code: 200
  selection_highprivilege:
    record_type|contains:
      - 'User'
      - 'Role'
      - 'System Manager'
  condition: selection_endpoint and selection_status and selection_highprivilege
falsepositives:
  - Legitimate administrators creating users or roles
level: high

YARA Rule

rule CVE_2026_109667_ERPNext_PrivEsc
{
    meta:
        author = "valtersit.com"
        description = "Detects ERPNext record-creation abuse patterns associated with CVE-2026-109667"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109667"
        date = "2026-01-01"

    strings:
        $a = "ignore_permissions" ascii nocase
        $b = "ignore_perms" ascii nocase
        $c = "doctype" ascii nocase
        $d = "frappe.new_doc" ascii nocase
        $e = "insert()" ascii nocase

    condition:
        uint32(0) == 0x04034b50 or
        ($c and ($a or $b)) or
        ($d and $e and $a)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109667 ERPNext Privilege Escalation via Record-Creation Endpoint"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"frappe"; http.request_body; content:"ignore_permissions"; http.request_body; content:"User"; nocase; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109667; sid:2026109667; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where http.request.method == "POST" and url.path : "*frappe*" ]
  [ network where http.request.method == "POST" and url.path : "*frappe*"
      and http.request.body : ("ignore_permissions" or "User" or "Role") ]

Splunk SPL Query

index=web sourcetype=erpnext OR sourcetype=access_combined
| search method=POST uri="*frappe*"
| eval suspicious=if(match(_raw, "(?i)ignore_permissions") OR match(_raw, "(?i)doctype.*User"), 1, 0)
| where suspicious=1
| stats count values(uri) as endpoints values(src_ip) as src_ips by user
| where count > 0

Wazuh OSSEC Rule

<group name="erpnext,web,privilege_escalation,">
  <rule id="202610" level="12">
    <decoded_as>json</decoded_as>
    <field name="http.url">frappe</field>
    <field name="http.method">POST</field>
    <match>ignore_permissions</match>
    <description>CVE-2026-109667: Possible ERPNext privilege escalation via record-creation endpoint</description>
    <group>cve_2026_109667,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the vulnerability is fixed in ERPNext 15.111.0 and 16.22.0, but no vendor advisory, commit, or patch reference has been confirmed by tracked sources. Treat any upgrade path as the vendor-identified fix and validate it directly against the vendor's release notes before relying on it.

1. Immediate mitigations (until a verified patch is applied):

   • Restrict network exposure of ERPNext. Place the application behind a VPN, zero-trust proxy, or IP allowlist so that only trusted users can reach the record-creation endpoint.
   • Enforce strong authentication and eliminate self-registration / open sign-up, since the attack requires only any authenticated account. Audit all existing accounts and disable dormant or unnecessary ones.
   • Apply least privilege to roles. Remove default "no operational role" accounts that nonetheless have session access, and minimize the number of accounts that can authenticate at all.
   • Deploy the detection rules above to monitor for creation of privileged record types (users, roles) by accounts that should not perform those actions.
   • Monitor and alert on anomalous account provisioning and role changes in ERPNext.

2. Patch / upgrade steps:

   • Upgrade to ERPNext 15.111.0 or later (15.x branch) or 16.22.0 or later (16.x branch), per the version ranges in the NVD description.
   • Because patch confidence is 0/4 with no tracked patch source, confirm the fix by testing that a low-privileged authenticated user can no longer create privileged record types after upgrading.
   • Maintain a tested rollback/backup before upgrading production ERP instances.

3. Long-term hardening:

   • Adopt an authorization model that binds permitted record types to the requesting principal and never disables permission checks on privileged insert paths.
   • Institute code review controls that flag request-controlled parameters feeding privileged server-side operations.
   • Subscribe to Frappe/ERPNext security advisories and track CVEs affecting the platform; maintain an inventory so newly disclosed versions can be remediated quickly.
   • Log and review all record creation involving privileged doctypes as a standing control.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109667
• CWE-269 Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
• MITRE ATT&CK T1068 Exploitation for Privilege Escalation: https://attack.mitre.org/techniques/T1068/
• Frappe/ERPNext project: https://github.com/frappe/erpnext
• CISA Known Exploited Vulnerabilities catalog (status check — not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template exists as of this writing. No threat actor campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-109667.