CVE-2026-109668

Executive Summary

CVE-2026-109668 is a missing authorization vulnerability (CWE-862) in Frappe ERPNext affecting versions before 15.110.0 and 16.x before 16.21.0. Authenticated users with low-privileged accounts can send requests to certain endpoints that handle party records and modify data beyond their permitted role. The impact is limited to integrity (CVSS 4.3, I:L) as unauthorized modification of party records — not confidentiality or availability.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862). In the ERPNext application, the flaw resides in "certain endpoints that handle party records." The NVD description states that these endpoints fail to enforce authorization checks, allowing an authenticated user holding a low-privileged role to make unauthorized changes to party records. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) indicates the attack is network-reachable, requires low privileges (a valid low-privileged account), requires no user interaction, and affects only the integrity of the vulnerable component with limited impact. No confidentiality or availability impact is scored.

Critical limitation: the provided description does not disclose the exact endpoint paths, HTTP methods, parameter names, controller/class names, or the specific authorization decorator/check that is missing. Therefore, no code-level specifics (function names, route strings, or parameter names) are asserted here. What can be stated generally is that in web frameworks, missing authorization typically arises when a route handler performs authentication (verifying a session/user) but omits a role/permission check on the requested operation, so any authenticated account can invoke it. In ERPNext/party-record contexts, "party" refers to business entities such as customers and suppliers; the flawed endpoints allow modifications to such records without validating the caller's role permissions.

Attack surface: the ERPNext web application's HTTP API/request handling layer for party records, reachable by any authenticated session. There is no public PoC, no Nuclei template, and no exploit code referenced in the provided data; the mechanism is inferred from the CWE-862 class and the NVD text. No EPSS score is available (not yet scored by FIRST.org). This CVE is not listed in CISA KEV, and no exploitation in the wild is evidenced by the supplied data.

Exploitation Scenarios

Because no public PoC exists and the description is sparse, the following chain is described at the vulnerability-class level. No specific endpoint names, parameters, or function names are invented.

1. Reconnaissance / target identification: The attacker identifies an internet- or intranet-exposed ERPNext instance (affected versions < 15.110.0 / 16.x < 16.21.0). The attacker obtains a valid low-privileged account — this could be a legitimate low-privilege user, a self-registered account where registration is enabled, or credentials obtained through unrelated means. Mapping of endpoints that handle party records would be performed by observing application responses or reading available documentation.

2. Triggering the flaw class: Missing authorization means the server authenticates the request (valid session) but does not verify that the caller's role is permitted to perform the action on party records. The attacker, using their low-privileged session, sends a request to an affected party-record endpoint that performs a state-changing operation. Because the authorization check is absent, the server processes the request rather than returning a permission-denied response.

3. Execution method (class level): The request is a standard authenticated web/API request directed at the vulnerable endpoint. No exploit payload, memory corruption primitive, or injection string is involved — the "exploit" is simply a legitimate-looking request issued by an unauthorized role. Elevated crafting is not required beyond having a session and knowing which endpoints handle party records.

4. Post-exploitation impact: Unauthorized modification of party records — for example, altering data associated with customer or supplier entities. This is an integrity-only, limited-impact outcome per the CVSS vector (I:L). It could corrupt master data used by downstream financial or procurement workflows, but the provided data does not support claims of data exfiltration, privilege escalation beyond the affected records, or availability loss.

Caveat: No public PoC is available; the above chain is inferred from the vulnerability class (CWE-862) and must be validated against the actual fixed-version diff before operational use.

Impact Assessment

Business impact centers on data integrity of party records (e.g., customer/supplier master data) within ERPNext. An authenticated low-privileged user can make unauthorized changes they are not entitled to perform. CVSS subscores: AV:N (remotely reachable), AC:L (no special conditions), PR:L (requires low privileges), UI:N (no user interaction), S:U (impact scoped to the vulnerable component), C:N (no confidentiality impact), I:L (limited integrity impact), A:N (no availability impact). The blast radius is bounded by the authorization gap on the affected party-record endpoints; because no confidentiality or availability impact is scored, the primary risk is data corruption/tampering and potential downstream workflow disruption. Affected systems are ERPNext deployments running versions before 15.110.0 and 16.x before 16.21.0. Organizations relying on role-based segregation of duties should treat this as a control failure that undermines least-privilege enforcement.

Detection Guidance

Sigma Rule

title: ERPNext Missing Authorization - Unauthorized Party Record Modification
id: 6b2f1c9a-4d3e-4a17-9c2b-7f0a1e8d5c44
status: experimental
description: Detects low-privileged ERPNext users issuing state-changing requests to party-record endpoints, indicative of CVE-2026-109668 (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-109668
author: valtersit.com
logsource:
  product: erpnext
  service: web
detection:
  selection_method:
    http.method:
      - POST
      - PUT
      - PATCH
      - DELETE
  selection_path:
    url.path|contains:
      - 'party'
  selection_lowpriv:
    user.role:
      - 'Customer'
      - 'Supplier'
      - 'Guest'
      - 'Website User'
      - 'Employee'
  condition: selection_method and selection_path and selection_lowpriv
falsepositives:
  - Legitimate low-privileged users with explicitly granted party-record permissions
  - Administrative bulk operations
level: medium
tags:
  - attack.t1078
  - cwe.862

YARA Rule

rule CVE_2026_109668_ERPNext_Party_Authorization
{
    meta:
        description = "Heuristic detection of ERPNext party-record authorization bypass references (CVE-2026-109668)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-109668"
        date = "2026-01-01"
    strings:
        $a = "erpnext" nocase
        $b = "frappe" nocase
        $c1 = "party" nocase
        $c2 = "permission" nocase
        $c3 = "authoriz" nocase
    condition:
        filesize < 5MB and
        (($a or $b) and $c1 and ($c2 or $c3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-109668 ERPNext Unauthorized Party Record Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"party"; nocase; http.header; content:"Cookie"; nocase; reference:cve,2026-109668; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-109668; classtype:attempted-user; sid:2026109668; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.roles : ("Customer","Supplier","Website User","Employee") ]
  [ network where http.request.method in ("POST","PUT","PATCH","DELETE") and
    url.path : "*party*" ]

Splunk SPL Query

index=web sourcetype=erpnext:access
(http.method=POST OR http.method=PUT OR http.method=PATCH OR http.method=DELETE)
url="*party*"
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, url, http.method
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="erpnext,web,">
  <rule id="100668" level="8">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST|PUT|PATCH|DELETE</field>
    <field name="url" type="pcre2">(?i)party</field>
    <description>CVE-2026-109668: Possible unauthorized ERPNext party-record modification attempt</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The description references fixed versions 15.110.0 and 16.21.0, but no vendor advisory, commit, or patch source is confirmed in the provided data. Treat as unpatched until verified.

1. Immediate mitigations:

• Restrict network exposure of ERPNext admin/app endpoints to trusted networks or VPN; do not expose to the public internet where avoidable.
• Enforce least privilege: audit and minimize roles assigned to low-privileged accounts; disable self-registration and remove stale/unused accounts.
• Apply reverse-proxy/WAF monitoring for abnormal state-changing requests to party-record endpoints by low-privileged users.
• Where feasible, temporarily restrict which roles can reach party-record modifying endpoints via server-side role configuration (validate against the actual application behavior — do not assume specific config keys).

2. Patch/upgrade steps:

• Verify availability of fixed releases 15.110.0 / 16.21.0 through official Frappe/ERPNext channels (GitHub releases, vendor advisories). The provided data contains no verified patch reference, so confirm before upgrading.
• Stage upgrades in a non-production environment, back up the database, and validate that the authorization check is corrected.

3. Long-term hardening:

• Implement and enforce server-side authorization checks on every state-changing endpoint (deny-by-default), with automated tests asserting role permission boundaries.
• Add monitoring/alerting for authorization anomalies and audit logging of party-record changes.
• Adopt a regular patch cadence and track ERPNext security advisories.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-109668
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• Frappe ERPNext releases (verify fixed versions 15.110.0 / 16.21.0): https://github.com/frappe/erpnext/releases
• FIRST EPSS (score not yet available): https://www.first.org/epss/

Note on exploitation evidence: The provided data indicates no public PoC, no Nuclei template, no exploit code, and no CISA KEV listing. No threat actor campaigns or in-the-wild exploitation are evidenced by the supplied intelligence.