{"schema_version":"2","view":"grouped","data":[{"id":42219,"cve_ids":["CVE-2026-108373"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised access to financial data due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.","evidence":"cve:CVE-2026-108373","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108373","aliases":["CVE-2026-108373"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.118.0"},{"status":"affected","version":">= 16.0.0, < 16.27.0"}]}],"modified":"2026-10-19T21:26:03.462Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e","https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7","https://github.com/frappe/erpnext/releases/tag/v15.118.0","https://github.com/frappe/erpnext/releases/tag/v16.27.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108373","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:25:49.884889Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:26:03.462Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:48:46.241Z"}}},"related_cves":[{"value":"CVE-2026-108373","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62f8c83e-a121-4859-8270-cd391fce4270","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108373","advisory_id":"62f8c83e-a121-4859-8270-cd391fce4270","event_types":["advisory"],"published_at":"2026-10-25T11:26:30.552895+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:48:46.241+00:00","detail_url":"/advisories/advisory%3A62f8c83e-a121-4859-8270-cd391fce4270","group":{"id":"advisory:62f8c83e-a121-4859-8270-cd391fce4270","revision":1,"primary_event_id":41826,"change":"published","superseded_by":[],"changed":{"id":41826,"cve_ids":["CVE-2026-108373"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised access to financial data due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.","evidence":"cve:CVE-2026-108373","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108373","aliases":["CVE-2026-108373"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.118.0"},{"status":"affected","version":">= 16.0.0, < 16.27.0"}]}],"modified":"2026-10-19T21:26:03.462Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e","https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7","https://github.com/frappe/erpnext/releases/tag/v15.118.0","https://github.com/frappe/erpnext/releases/tag/v16.27.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108373","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:25:49.884889Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:26:03.462Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:48:46.241Z"}}},"related_cves":[{"value":"CVE-2026-108373","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62f8c83e-a121-4859-8270-cd391fce4270","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108373","advisory_id":"62f8c83e-a121-4859-8270-cd391fce4270","event_types":["advisory"],"published_at":"2026-10-25T11:26:30.552895+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:48:46.241+00:00","detail_url":"/events/41826"},"members":[{"id":41826,"cve_ids":["CVE-2026-108373"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised access to financial data due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.","evidence":"cve:CVE-2026-108373","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-108373","aliases":["CVE-2026-108373"],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.118.0"},{"status":"affected","version":">= 16.0.0, < 16.27.0"}]}],"modified":"2026-10-19T21:26:03.462Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://github.com/frappe/erpnext/commit/202f52271ca2f689c2836fc27ca30c9cd507958e","https://github.com/frappe/erpnext/commit/24f0989ac1f6d3054643d6377e8c126ee8ca0cf7","https://github.com/frappe/erpnext/releases/tag/v15.118.0","https://github.com/frappe/erpnext/releases/tag/v16.27.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108373","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T21:25:49.884889Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T21:26:03.462Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:48:46.241Z"}}},"related_cves":[{"value":"CVE-2026-108373","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:62f8c83e-a121-4859-8270-cd391fce4270","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108373","advisory_id":"62f8c83e-a121-4859-8270-cd391fce4270","event_types":["advisory"],"published_at":"2026-10-25T11:26:30.552895+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:48:46.241+00:00","detail_url":"/events/41826"}]}},{"id":39232,"cve_ids":["CVE-2026-108374"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised status modification due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.","evidence":"cve:CVE-2026-108374","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-108374","aliases":["CVE-2026-108374"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.121.0"},{"status":"affected","version":">= 16.0.0, < 16.34.0"}]}],"modified":"2026-10-19T14:29:00.708Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7","https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89","https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03","https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef","https://github.com/frappe/erpnext/releases/tag/v15.121.0","https://github.com/frappe/erpnext/releases/tag/v16.34.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108374","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:28:27.458789Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:29:00.708Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:38:32.806Z"}}},"related_cves":[{"value":"CVE-2026-108374","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108374","advisory_id":"7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","event_types":["advisory"],"published_at":"2026-10-25T10:37:29.156648+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:38:32.806+00:00","detail_url":"/advisories/advisory%3A7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","group":{"id":"advisory:7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","revision":1,"primary_event_id":38878,"change":"published","superseded_by":[],"changed":{"id":38878,"cve_ids":["CVE-2026-108374"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised status modification due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.","evidence":"cve:CVE-2026-108374","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-108374","aliases":["CVE-2026-108374"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.121.0"},{"status":"affected","version":">= 16.0.0, < 16.34.0"}]}],"modified":"2026-10-19T14:29:00.708Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7","https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89","https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03","https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef","https://github.com/frappe/erpnext/releases/tag/v15.121.0","https://github.com/frappe/erpnext/releases/tag/v16.34.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108374","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:28:27.458789Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:29:00.708Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:38:32.806Z"}}},"related_cves":[{"value":"CVE-2026-108374","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108374","advisory_id":"7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","event_types":["advisory"],"published_at":"2026-10-25T10:37:29.156648+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:38:32.806+00:00","detail_url":"/events/38878"},"members":[{"id":38878,"cve_ids":["CVE-2026-108374"],"payload":{"kind":"advisory","title":"ERPNext: Unauthorised status modification due to missing validation","summary":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.","evidence":"cve:CVE-2026-108374","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-108374","aliases":["CVE-2026-108374"],"metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":7.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"< 15.121.0"},{"status":"affected","version":">= 16.0.0, < 16.34.0"}]}],"modified":"2026-10-19T14:29:00.708Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7","https://github.com/frappe/erpnext/commit/547d82da563380a0644919173e00d0205f986d89","https://github.com/frappe/erpnext/commit/86e94803629ea5668c2fc2d18afb5ca59fe2cf03","https://github.com/frappe/erpnext/commit/a20fc4f9317ecc7d262625aea680c9a0cda98cef","https://github.com/frappe/erpnext/releases/tag/v15.121.0","https://github.com/frappe/erpnext/releases/tag/v16.34.0"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-108374","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-19T14:28:27.458789Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-19T14:29:00.708Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-10-16T20:38:32.806Z"}}},"related_cves":[{"value":"CVE-2026-108374","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108374","advisory_id":"7d5e0c6f-81fa-4429-8bc4-a4fecdea0b46","event_types":["advisory"],"published_at":"2026-10-25T10:37:29.156648+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-16T20:38:32.806+00:00","detail_url":"/events/38878"}]}},{"id":35005,"cve_ids":["CVE-2026-109670"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.","evidence":"cve:CVE-2026-109670","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109670","aliases":["CVE-2026-109670"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.880Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m6x2-278g-pv2g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-stored-xss-via-item-record-name"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109670","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:58.595314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:35.500Z"}}},"related_cves":[{"value":"CVE-2026-109670","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e5c84d5-30bc-4817-8e4e-388e579c6e4e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109670","advisory_id":"8e5c84d5-30bc-4817-8e4e-388e579c6e4e","event_types":["advisory"],"published_at":"2026-10-25T09:27:33.218357+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:35.5+00:00","detail_url":"/advisories/advisory%3A8e5c84d5-30bc-4817-8e4e-388e579c6e4e","group":{"id":"advisory:8e5c84d5-30bc-4817-8e4e-388e579c6e4e","revision":1,"primary_event_id":34708,"change":"published","superseded_by":[],"changed":{"id":34708,"cve_ids":["CVE-2026-109670"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.","evidence":"cve:CVE-2026-109670","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109670","aliases":["CVE-2026-109670"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.880Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m6x2-278g-pv2g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-stored-xss-via-item-record-name"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109670","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:58.595314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:35.500Z"}}},"related_cves":[{"value":"CVE-2026-109670","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e5c84d5-30bc-4817-8e4e-388e579c6e4e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109670","advisory_id":"8e5c84d5-30bc-4817-8e4e-388e579c6e4e","event_types":["advisory"],"published_at":"2026-10-25T09:27:33.218357+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:35.5+00:00","detail_url":"/events/34708"},"members":[{"id":34708,"cve_ids":["CVE-2026-109670"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any operator who opens the affected page.","evidence":"cve:CVE-2026-109670","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109670","aliases":["CVE-2026-109670"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.1,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"LOW","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5.4,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","integrityImpact":"LOW","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:32.880Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m6x2-278g-pv2g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-stored-xss-via-item-record-name"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109670","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:58.595314Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:32.880Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:35.500Z"}}},"related_cves":[{"value":"CVE-2026-109670","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8e5c84d5-30bc-4817-8e4e-388e579c6e4e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109670","advisory_id":"8e5c84d5-30bc-4817-8e4e-388e579c6e4e","event_types":["advisory"],"published_at":"2026-10-25T09:27:33.218357+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:35.5+00:00","detail_url":"/events/34708"}]}},{"id":35004,"cve_ids":["CVE-2026-109665"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation","summary":"Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.","evidence":"cve:CVE-2026-109665","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109665","aliases":["CVE-2026-109665"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.108.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.18.0","versionType":"semver"},{"status":"unaffected","version":"15.108.0","versionType":"semver"},{"status":"unaffected","version":"16.18.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.036Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j57j-p235-x5mx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.108.0-missing-authorization-allows-master-record-deactivation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109665","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:46.592488Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.224Z"}}},"related_cves":[{"value":"CVE-2026-109665","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfa367b-6c86-4b4d-8e2c-fc604689e904","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109665","advisory_id":"ecfa367b-6c86-4b4d-8e2c-fc604689e904","event_types":["advisory"],"published_at":"2026-10-25T09:27:32.606789+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.224+00:00","detail_url":"/advisories/advisory%3Aecfa367b-6c86-4b4d-8e2c-fc604689e904","group":{"id":"advisory:ecfa367b-6c86-4b4d-8e2c-fc604689e904","revision":1,"primary_event_id":34707,"change":"published","superseded_by":[],"changed":{"id":34707,"cve_ids":["CVE-2026-109665"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation","summary":"Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.","evidence":"cve:CVE-2026-109665","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109665","aliases":["CVE-2026-109665"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.108.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.18.0","versionType":"semver"},{"status":"unaffected","version":"15.108.0","versionType":"semver"},{"status":"unaffected","version":"16.18.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.036Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j57j-p235-x5mx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.108.0-missing-authorization-allows-master-record-deactivation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109665","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:46.592488Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.224Z"}}},"related_cves":[{"value":"CVE-2026-109665","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfa367b-6c86-4b4d-8e2c-fc604689e904","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109665","advisory_id":"ecfa367b-6c86-4b4d-8e2c-fc604689e904","event_types":["advisory"],"published_at":"2026-10-25T09:27:32.606789+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.224+00:00","detail_url":"/events/34707"},"members":[{"id":34707,"cve_ids":["CVE-2026-109665"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation","summary":"Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role.","evidence":"cve:CVE-2026-109665","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109665","aliases":["CVE-2026-109665"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.108.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.18.0","versionType":"semver"},{"status":"unaffected","version":"15.108.0","versionType":"semver"},{"status":"unaffected","version":"16.18.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.036Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j57j-p235-x5mx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.108.0-missing-authorization-allows-master-record-deactivation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109665","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:46.592488Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.036Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.224Z"}}},"related_cves":[{"value":"CVE-2026-109665","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ecfa367b-6c86-4b4d-8e2c-fc604689e904","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109665","advisory_id":"ecfa367b-6c86-4b4d-8e2c-fc604689e904","event_types":["advisory"],"published_at":"2026-10-25T09:27:32.606789+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.224+00:00","detail_url":"/events/34707"}]}},{"id":35003,"cve_ids":["CVE-2026-109655"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.","evidence":"cve:CVE-2026-109655","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109655","aliases":["CVE-2026-109655"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.321Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fhc6-v53v-3wjx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-in-inventory-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:21.427525Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.321Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:25.822Z"}}},"related_cves":[{"value":"CVE-2026-109655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:82d5b62a-34b8-4832-8b7f-36417882648f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109655","advisory_id":"82d5b62a-34b8-4832-8b7f-36417882648f","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.919632+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:25.822+00:00","detail_url":"/advisories/advisory%3A82d5b62a-34b8-4832-8b7f-36417882648f","group":{"id":"advisory:82d5b62a-34b8-4832-8b7f-36417882648f","revision":1,"primary_event_id":34706,"change":"published","superseded_by":[],"changed":{"id":34706,"cve_ids":["CVE-2026-109655"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.","evidence":"cve:CVE-2026-109655","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109655","aliases":["CVE-2026-109655"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.321Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fhc6-v53v-3wjx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-in-inventory-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:21.427525Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.321Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:25.822Z"}}},"related_cves":[{"value":"CVE-2026-109655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:82d5b62a-34b8-4832-8b7f-36417882648f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109655","advisory_id":"82d5b62a-34b8-4832-8b7f-36417882648f","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.919632+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:25.822+00:00","detail_url":"/events/34706"},"members":[{"id":34706,"cve_ids":["CVE-2026-109655"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role.","evidence":"cve:CVE-2026-109655","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109655","aliases":["CVE-2026-109655"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.321Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fhc6-v53v-3wjx","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-in-inventory-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109655","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:21.427525Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.321Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:25.822Z"}}},"related_cves":[{"value":"CVE-2026-109655","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:82d5b62a-34b8-4832-8b7f-36417882648f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109655","advisory_id":"82d5b62a-34b8-4832-8b7f-36417882648f","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.919632+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:25.822+00:00","detail_url":"/events/34706"}]}},{"id":35002,"cve_ids":["CVE-2026-109660"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109660","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109660","aliases":["CVE-2026-109660"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.178Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fmr9-rm6j-cfpq","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-in-production-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109660","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:33.380804Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.178Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:28.973Z"}}},"related_cves":[{"value":"CVE-2026-109660","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81fee671-e92f-4335-a33c-9808a101a086","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109660","advisory_id":"81fee671-e92f-4335-a33c-9808a101a086","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.301981+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:28.973+00:00","detail_url":"/advisories/advisory%3A81fee671-e92f-4335-a33c-9808a101a086","group":{"id":"advisory:81fee671-e92f-4335-a33c-9808a101a086","revision":1,"primary_event_id":34705,"change":"published","superseded_by":[],"changed":{"id":34705,"cve_ids":["CVE-2026-109660"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109660","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109660","aliases":["CVE-2026-109660"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.178Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fmr9-rm6j-cfpq","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-in-production-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109660","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:33.380804Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.178Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:28.973Z"}}},"related_cves":[{"value":"CVE-2026-109660","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81fee671-e92f-4335-a33c-9808a101a086","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109660","advisory_id":"81fee671-e92f-4335-a33c-9808a101a086","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.301981+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:28.973+00:00","detail_url":"/events/34705"},"members":[{"id":34705,"cve_ids":["CVE-2026-109660"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109660","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109660","aliases":["CVE-2026-109660"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.178Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-fmr9-rm6j-cfpq","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-in-production-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109660","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:33.380804Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.178Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:28.973Z"}}},"related_cves":[{"value":"CVE-2026-109660","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:81fee671-e92f-4335-a33c-9808a101a086","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109660","advisory_id":"81fee671-e92f-4335-a33c-9808a101a086","event_types":["advisory"],"published_at":"2026-10-25T09:27:31.301981+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:28.973+00:00","detail_url":"/events/34705"}]}},{"id":35001,"cve_ids":["CVE-2026-109650"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109650","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109650","aliases":["CVE-2026-109650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.461Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-39rf-vr57-g568","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-exposes-personal-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109650","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:05.634513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.461Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:22.629Z"}}},"related_cves":[{"value":"CVE-2026-109650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22083dd0-a737-4f5c-ad19-3c2025ef1e57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109650","advisory_id":"22083dd0-a737-4f5c-ad19-3c2025ef1e57","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.671079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:22.629+00:00","detail_url":"/advisories/advisory%3A22083dd0-a737-4f5c-ad19-3c2025ef1e57","group":{"id":"advisory:22083dd0-a737-4f5c-ad19-3c2025ef1e57","revision":1,"primary_event_id":34704,"change":"published","superseded_by":[],"changed":{"id":34704,"cve_ids":["CVE-2026-109650"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109650","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109650","aliases":["CVE-2026-109650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.461Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-39rf-vr57-g568","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-exposes-personal-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109650","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:05.634513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.461Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:22.629Z"}}},"related_cves":[{"value":"CVE-2026-109650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22083dd0-a737-4f5c-ad19-3c2025ef1e57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109650","advisory_id":"22083dd0-a737-4f5c-ad19-3c2025ef1e57","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.671079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:22.629+00:00","detail_url":"/events/34704"},"members":[{"id":34704,"cve_ids":["CVE-2026-109650"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109650","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109650","aliases":["CVE-2026-109650"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.461Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-39rf-vr57-g568","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-missing-authorization-exposes-personal-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109650","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:05:05.634513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.461Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:22.629Z"}}},"related_cves":[{"value":"CVE-2026-109650","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:22083dd0-a737-4f5c-ad19-3c2025ef1e57","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109650","advisory_id":"22083dd0-a737-4f5c-ad19-3c2025ef1e57","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.671079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:22.629+00:00","detail_url":"/events/34704"}]}},{"id":35000,"cve_ids":["CVE-2026-109645"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109645","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109645","aliases":["CVE-2026-109645"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.31.0","versionType":"semver"},{"status":"unaffected","version":"15.119.0","versionType":"semver"},{"status":"unaffected","version":"16.31.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.599Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m5xh-ghvj-xjrv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.0-unauthorized-record-creation-via-missing-authorization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109645","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:04:52.068300Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.599Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.345Z"}}},"related_cves":[{"value":"CVE-2026-109645","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d1d7875-6023-462f-8449-3621e6f0a910","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109645","advisory_id":"3d1d7875-6023-462f-8449-3621e6f0a910","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.011012+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.345+00:00","detail_url":"/advisories/advisory%3A3d1d7875-6023-462f-8449-3621e6f0a910","group":{"id":"advisory:3d1d7875-6023-462f-8449-3621e6f0a910","revision":1,"primary_event_id":34703,"change":"published","superseded_by":[],"changed":{"id":34703,"cve_ids":["CVE-2026-109645"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109645","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109645","aliases":["CVE-2026-109645"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.31.0","versionType":"semver"},{"status":"unaffected","version":"15.119.0","versionType":"semver"},{"status":"unaffected","version":"16.31.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.599Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m5xh-ghvj-xjrv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.0-unauthorized-record-creation-via-missing-authorization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109645","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:04:52.068300Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.599Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.345Z"}}},"related_cves":[{"value":"CVE-2026-109645","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d1d7875-6023-462f-8449-3621e6f0a910","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109645","advisory_id":"3d1d7875-6023-462f-8449-3621e6f0a910","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.011012+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.345+00:00","detail_url":"/events/34703"},"members":[{"id":34703,"cve_ids":["CVE-2026-109645"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization","summary":"Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109645","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109645","aliases":["CVE-2026-109645"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.31.0","versionType":"semver"},{"status":"unaffected","version":"15.119.0","versionType":"semver"},{"status":"unaffected","version":"16.31.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:23:33.599Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-m5xh-ghvj-xjrv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.0-unauthorized-record-creation-via-missing-authorization"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109645","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T12:04:52.068300Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:23:33.599Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.345Z"}}},"related_cves":[{"value":"CVE-2026-109645","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3d1d7875-6023-462f-8449-3621e6f0a910","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109645","advisory_id":"3d1d7875-6023-462f-8449-3621e6f0a910","event_types":["advisory"],"published_at":"2026-10-25T09:27:30.011012+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.345+00:00","detail_url":"/events/34703"}]}},{"id":34999,"cve_ids":["CVE-2026-109635"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints","summary":"Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.","evidence":"cve:CVE-2026-109635","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109635","aliases":["CVE-2026-109635"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.105.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.15.0","versionType":"semver"},{"status":"unaffected","version":"15.105.0","versionType":"semver"},{"status":"unaffected","version":"16.15.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.316Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-562g-3qrh-3w2f","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.105.0-missing-authorization-in-document-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109635","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:43.854796Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:12.936Z"}}},"related_cves":[{"value":"CVE-2026-109635","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:535a78bf-f481-4ef8-8e0d-afd04a7de5f1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109635","advisory_id":"535a78bf-f481-4ef8-8e0d-afd04a7de5f1","event_types":["advisory"],"published_at":"2026-10-25T09:27:29.015039+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:12.936+00:00","detail_url":"/advisories/advisory%3A535a78bf-f481-4ef8-8e0d-afd04a7de5f1","group":{"id":"advisory:535a78bf-f481-4ef8-8e0d-afd04a7de5f1","revision":1,"primary_event_id":34702,"change":"published","superseded_by":[],"changed":{"id":34702,"cve_ids":["CVE-2026-109635"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints","summary":"Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.","evidence":"cve:CVE-2026-109635","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109635","aliases":["CVE-2026-109635"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.105.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.15.0","versionType":"semver"},{"status":"unaffected","version":"15.105.0","versionType":"semver"},{"status":"unaffected","version":"16.15.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.316Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-562g-3qrh-3w2f","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.105.0-missing-authorization-in-document-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109635","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:43.854796Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:12.936Z"}}},"related_cves":[{"value":"CVE-2026-109635","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:535a78bf-f481-4ef8-8e0d-afd04a7de5f1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109635","advisory_id":"535a78bf-f481-4ef8-8e0d-afd04a7de5f1","event_types":["advisory"],"published_at":"2026-10-25T09:27:29.015039+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:12.936+00:00","detail_url":"/events/34702"},"members":[{"id":34702,"cve_ids":["CVE-2026-109635"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints","summary":"Frappe ERPNext before 15.105.0 and 16.x before 16.15.0 contains a missing authorization vulnerability in certain document creation endpoints that fail to verify that the requesting portal user belongs to the target party. Authenticated portal users can send requests to these endpoints to create documents on behalf of parties other than their own.","evidence":"cve:CVE-2026-109635","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109635","aliases":["CVE-2026-109635"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.105.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.15.0","versionType":"semver"},{"status":"unaffected","version":"15.105.0","versionType":"semver"},{"status":"unaffected","version":"16.15.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.316Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-562g-3qrh-3w2f","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.105.0-missing-authorization-in-document-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109635","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:43.854796Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.316Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:12.936Z"}}},"related_cves":[{"value":"CVE-2026-109635","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:535a78bf-f481-4ef8-8e0d-afd04a7de5f1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109635","advisory_id":"535a78bf-f481-4ef8-8e0d-afd04a7de5f1","event_types":["advisory"],"published_at":"2026-10-25T09:27:29.015039+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:12.936+00:00","detail_url":"/events/34702"}]}},{"id":34998,"cve_ids":["CVE-2026-109630"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109630","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109630","aliases":["CVE-2026-109630"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.472Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pr7v-95jp-gwwv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109630","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:00.586733Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:09.679Z"}}},"related_cves":[{"value":"CVE-2026-109630","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:aff49aea-6fed-438e-8c1e-c2f8820e3d77","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109630","advisory_id":"aff49aea-6fed-438e-8c1e-c2f8820e3d77","event_types":["advisory"],"published_at":"2026-10-25T09:27:28.234784+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:09.679+00:00","detail_url":"/advisories/advisory%3Aaff49aea-6fed-438e-8c1e-c2f8820e3d77","group":{"id":"advisory:aff49aea-6fed-438e-8c1e-c2f8820e3d77","revision":1,"primary_event_id":34701,"change":"published","superseded_by":[],"changed":{"id":34701,"cve_ids":["CVE-2026-109630"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109630","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109630","aliases":["CVE-2026-109630"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.472Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pr7v-95jp-gwwv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109630","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:00.586733Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:09.679Z"}}},"related_cves":[{"value":"CVE-2026-109630","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:aff49aea-6fed-438e-8c1e-c2f8820e3d77","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109630","advisory_id":"aff49aea-6fed-438e-8c1e-c2f8820e3d77","event_types":["advisory"],"published_at":"2026-10-25T09:27:28.234784+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:09.679+00:00","detail_url":"/events/34701"},"members":[{"id":34701,"cve_ids":["CVE-2026-109630"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated attackers can call these endpoints to read data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109630","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109630","aliases":["CVE-2026-109630"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.472Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pr7v-95jp-gwwv","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109630","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:00.586733Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.472Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:09.679Z"}}},"related_cves":[{"value":"CVE-2026-109630","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:aff49aea-6fed-438e-8c1e-c2f8820e3d77","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109630","advisory_id":"aff49aea-6fed-438e-8c1e-c2f8820e3d77","event_types":["advisory"],"published_at":"2026-10-25T09:27:28.234784+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:09.679+00:00","detail_url":"/events/34701"}]}},{"id":34997,"cve_ids":["CVE-2026-109625"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.","evidence":"cve:CVE-2026-109625","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109625","aliases":["CVE-2026-109625"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.3","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.35.0","versionType":"semver"},{"status":"unaffected","version":"15.121.3","versionType":"semver"},{"status":"unaffected","version":"16.35.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.616Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-726x-68g4-fj9v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.3-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:34.680635Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.616Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:06.397Z"}}},"related_cves":[{"value":"CVE-2026-109625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24e77789-4f7e-4dea-87c3-abf7a3c481d1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109625","advisory_id":"24e77789-4f7e-4dea-87c3-abf7a3c481d1","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.631568+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:06.397+00:00","detail_url":"/advisories/advisory%3A24e77789-4f7e-4dea-87c3-abf7a3c481d1","group":{"id":"advisory:24e77789-4f7e-4dea-87c3-abf7a3c481d1","revision":1,"primary_event_id":34700,"change":"published","superseded_by":[],"changed":{"id":34700,"cve_ids":["CVE-2026-109625"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.","evidence":"cve:CVE-2026-109625","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109625","aliases":["CVE-2026-109625"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.3","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.35.0","versionType":"semver"},{"status":"unaffected","version":"15.121.3","versionType":"semver"},{"status":"unaffected","version":"16.35.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.616Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-726x-68g4-fj9v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.3-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:34.680635Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.616Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:06.397Z"}}},"related_cves":[{"value":"CVE-2026-109625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24e77789-4f7e-4dea-87c3-abf7a3c481d1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109625","advisory_id":"24e77789-4f7e-4dea-87c3-abf7a3c481d1","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.631568+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:06.397+00:00","detail_url":"/events/34700"},"members":[{"id":34700,"cve_ids":["CVE-2026-109625"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted by their assigned role.","evidence":"cve:CVE-2026-109625","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109625","aliases":["CVE-2026-109625"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.3","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.35.0","versionType":"semver"},{"status":"unaffected","version":"15.121.3","versionType":"semver"},{"status":"unaffected","version":"16.35.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.616Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-726x-68g4-fj9v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.3-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109625","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:34.680635Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.616Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:06.397Z"}}},"related_cves":[{"value":"CVE-2026-109625","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:24e77789-4f7e-4dea-87c3-abf7a3c481d1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109625","advisory_id":"24e77789-4f7e-4dea-87c3-abf7a3c481d1","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.631568+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:06.397+00:00","detail_url":"/events/34700"}]}},{"id":34996,"cve_ids":["CVE-2026-109617"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.","evidence":"cve:CVE-2026-109617","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109617","aliases":["CVE-2026-109617"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.774Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-vr45-2p9x-3vjc","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109617","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:49.830785Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.774Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.078Z"}}},"related_cves":[{"value":"CVE-2026-109617","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8f64fa21-2543-487f-8ac6-fa66f045853b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109617","advisory_id":"8f64fa21-2543-487f-8ac6-fa66f045853b","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.024888+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.078+00:00","detail_url":"/advisories/advisory%3A8f64fa21-2543-487f-8ac6-fa66f045853b","group":{"id":"advisory:8f64fa21-2543-487f-8ac6-fa66f045853b","revision":1,"primary_event_id":34699,"change":"published","superseded_by":[],"changed":{"id":34699,"cve_ids":["CVE-2026-109617"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.","evidence":"cve:CVE-2026-109617","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109617","aliases":["CVE-2026-109617"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.774Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-vr45-2p9x-3vjc","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109617","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:49.830785Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.774Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.078Z"}}},"related_cves":[{"value":"CVE-2026-109617","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8f64fa21-2543-487f-8ac6-fa66f045853b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109617","advisory_id":"8f64fa21-2543-487f-8ac6-fa66f045853b","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.024888+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.078+00:00","detail_url":"/events/34699"},"members":[{"id":34699,"cve_ids":["CVE-2026-109617"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.","evidence":"cve:CVE-2026-109617","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109617","aliases":["CVE-2026-109617"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.774Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-vr45-2p9x-3vjc","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109617","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:49.830785Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.774Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.078Z"}}},"related_cves":[{"value":"CVE-2026-109617","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:8f64fa21-2543-487f-8ac6-fa66f045853b","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109617","advisory_id":"8f64fa21-2543-487f-8ac6-fa66f045853b","event_types":["advisory"],"published_at":"2026-10-25T09:27:27.024888+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.078+00:00","detail_url":"/events/34699"}]}},{"id":34994,"cve_ids":["CVE-2026-109612"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Stored XSS via Report View","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.","evidence":"cve:CVE-2026-109612","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109612","aliases":["CVE-2026-109612"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.33.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.33.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.928Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-f99r-gp2w-xghj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-stored-xss-via-report-view"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109612","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:08.266894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.928Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:59.712Z"}}},"related_cves":[{"value":"CVE-2026-109612","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5808883c-6fad-4f22-85ff-39fc13e156b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109612","advisory_id":"5808883c-6fad-4f22-85ff-39fc13e156b0","event_types":["advisory"],"published_at":"2026-10-25T09:27:26.374195+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:59.712+00:00","detail_url":"/advisories/advisory%3A5808883c-6fad-4f22-85ff-39fc13e156b0","group":{"id":"advisory:5808883c-6fad-4f22-85ff-39fc13e156b0","revision":1,"primary_event_id":34698,"change":"published","superseded_by":[],"changed":{"id":34698,"cve_ids":["CVE-2026-109612"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Stored XSS via Report View","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.","evidence":"cve:CVE-2026-109612","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109612","aliases":["CVE-2026-109612"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.33.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.33.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.928Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-f99r-gp2w-xghj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-stored-xss-via-report-view"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109612","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:08.266894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.928Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:59.712Z"}}},"related_cves":[{"value":"CVE-2026-109612","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5808883c-6fad-4f22-85ff-39fc13e156b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109612","advisory_id":"5808883c-6fad-4f22-85ff-39fc13e156b0","event_types":["advisory"],"published_at":"2026-10-25T09:27:26.374195+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:59.712+00:00","detail_url":"/events/34698"},"members":[{"id":34698,"cve_ids":["CVE-2026-109612"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Stored XSS via Report View","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.","evidence":"cve:CVE-2026-109612","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109612","aliases":["CVE-2026-109612"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.33.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.33.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:28.928Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-f99r-gp2w-xghj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-stored-xss-via-report-view"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109612","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:57:08.266894Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:28.928Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:59.712Z"}}},"related_cves":[{"value":"CVE-2026-109612","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:5808883c-6fad-4f22-85ff-39fc13e156b0","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109612","advisory_id":"5808883c-6fad-4f22-85ff-39fc13e156b0","event_types":["advisory"],"published_at":"2026-10-25T09:27:26.374195+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:59.712+00:00","detail_url":"/events/34698"}]}},{"id":34993,"cve_ids":["CVE-2026-109604"],"payload":{"kind":"advisory","title":"ERPNext before 15.112.0 Stored XSS via Tool View Record Names","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.","evidence":"cve:CVE-2026-109604","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109604","aliases":["CVE-2026-109604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:29.087Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-734c-hv9r-mg2c","https://www.vulncheck.com/advisories/erpnext-before-15.112.0-stored-xss-via-tool-view-record-names"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:56:57.483362Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:29.087Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:56.499Z"}}},"related_cves":[{"value":"CVE-2026-109604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109604","advisory_id":"1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","event_types":["advisory"],"published_at":"2026-10-25T09:27:25.756079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:56.499+00:00","detail_url":"/advisories/advisory%3A1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","group":{"id":"advisory:1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","revision":1,"primary_event_id":34697,"change":"published","superseded_by":[],"changed":{"id":34697,"cve_ids":["CVE-2026-109604"],"payload":{"kind":"advisory","title":"ERPNext before 15.112.0 Stored XSS via Tool View Record Names","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.","evidence":"cve:CVE-2026-109604","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109604","aliases":["CVE-2026-109604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:29.087Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-734c-hv9r-mg2c","https://www.vulncheck.com/advisories/erpnext-before-15.112.0-stored-xss-via-tool-view-record-names"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:56:57.483362Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:29.087Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:56.499Z"}}},"related_cves":[{"value":"CVE-2026-109604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109604","advisory_id":"1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","event_types":["advisory"],"published_at":"2026-10-25T09:27:25.756079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:56.499+00:00","detail_url":"/events/34697"},"members":[{"id":34697,"cve_ids":["CVE-2026-109604"],"payload":{"kind":"advisory","title":"ERPNext before 15.112.0 Stored XSS via Tool View Record Names","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.","evidence":"cve:CVE-2026-109604","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109604","aliases":["CVE-2026-109604"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:13:29.087Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-734c-hv9r-mg2c","https://www.vulncheck.com/advisories/erpnext-before-15.112.0-stored-xss-via-tool-view-record-names"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109604","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-18T11:56:57.483362Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:13:29.087Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:56.499Z"}}},"related_cves":[{"value":"CVE-2026-109604","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109604","advisory_id":"1e924f2f-68a9-4a39-ae6e-ffd83922e7b5","event_types":["advisory"],"published_at":"2026-10-25T09:27:25.756079+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:56.499+00:00","detail_url":"/events/34697"}]}},{"id":34972,"cve_ids":["CVE-2026-109640"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification","summary":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.","evidence":"cve:CVE-2026-109640","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109640","aliases":["CVE-2026-109640"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.22.0","versionType":"semver"},{"status":"unaffected","version":"16.22.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:03:18.129Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-c496-q7g2-62vv","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.22.0-missing-authorization-allows-unauthorized-record-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109640","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:20.951754Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:03:18.129Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.189Z"}}},"related_cves":[{"value":"CVE-2026-109640","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e32d6ce-0f4e-4397-aca4-541e291afbe1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109640","advisory_id":"1e32d6ce-0f4e-4397-aca4-541e291afbe1","event_types":["advisory"],"published_at":"2026-10-25T09:26:05.639305+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.189+00:00","detail_url":"/advisories/advisory%3A1e32d6ce-0f4e-4397-aca4-541e291afbe1","group":{"id":"advisory:1e32d6ce-0f4e-4397-aca4-541e291afbe1","revision":1,"primary_event_id":34676,"change":"published","superseded_by":[],"changed":{"id":34676,"cve_ids":["CVE-2026-109640"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification","summary":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.","evidence":"cve:CVE-2026-109640","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109640","aliases":["CVE-2026-109640"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.22.0","versionType":"semver"},{"status":"unaffected","version":"16.22.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:03:18.129Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-c496-q7g2-62vv","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.22.0-missing-authorization-allows-unauthorized-record-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109640","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:20.951754Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:03:18.129Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.189Z"}}},"related_cves":[{"value":"CVE-2026-109640","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e32d6ce-0f4e-4397-aca4-541e291afbe1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109640","advisory_id":"1e32d6ce-0f4e-4397-aca4-541e291afbe1","event_types":["advisory"],"published_at":"2026-10-25T09:26:05.639305+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.189+00:00","detail_url":"/events/34676"},"members":[{"id":34676,"cve_ids":["CVE-2026-109640"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification","summary":"Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper authorization checks. Attackers can call these endpoints to perform operations on records beyond their permitted role, resulting in unauthorized modification of data.","evidence":"cve:CVE-2026-109640","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109640","aliases":["CVE-2026-109640"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.22.0","versionType":"semver"},{"status":"unaffected","version":"16.22.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-18T12:03:18.129Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-c496-q7g2-62vv","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.22.0-missing-authorization-allows-unauthorized-record-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109640","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-18T11:58:20.951754Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-18T12:03:18.129Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.189Z"}}},"related_cves":[{"value":"CVE-2026-109640","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1e32d6ce-0f4e-4397-aca4-541e291afbe1","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109640","advisory_id":"1e32d6ce-0f4e-4397-aca4-541e291afbe1","event_types":["advisory"],"published_at":"2026-10-25T09:26:05.639305+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.189+00:00","detail_url":"/events/34676"}]}},{"id":29052,"cve_ids":["CVE-2026-109671"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.","evidence":"cve:CVE-2026-109671","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109671","aliases":["CVE-2026-109671"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.113.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.24.0","versionType":"semver"},{"status":"unaffected","version":"15.113.0","versionType":"semver"},{"status":"unaffected","version":"16.24.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:35:57.389Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rg9g-c26v-cw27","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-stored-xss-via-profile-field-in-portal-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:34:27.562780Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:35:57.389Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.142Z"}}},"related_cves":[{"value":"CVE-2026-109671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109671","advisory_id":"3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","event_types":["advisory"],"published_at":"2026-10-25T07:48:59.07569+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.142+00:00","detail_url":"/advisories/advisory%3A3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","group":{"id":"advisory:3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","revision":1,"primary_event_id":28824,"change":"published","superseded_by":[],"changed":{"id":28824,"cve_ids":["CVE-2026-109671"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.","evidence":"cve:CVE-2026-109671","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109671","aliases":["CVE-2026-109671"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.113.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.24.0","versionType":"semver"},{"status":"unaffected","version":"15.113.0","versionType":"semver"},{"status":"unaffected","version":"16.24.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:35:57.389Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rg9g-c26v-cw27","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-stored-xss-via-profile-field-in-portal-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:34:27.562780Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:35:57.389Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.142Z"}}},"related_cves":[{"value":"CVE-2026-109671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109671","advisory_id":"3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","event_types":["advisory"],"published_at":"2026-10-25T07:48:59.07569+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.142+00:00","detail_url":"/events/28824"},"members":[{"id":28824,"cve_ids":["CVE-2026-109671"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages","summary":"Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator viewing those pages, enabling administrator account takeover.","evidence":"cve:CVE-2026-109671","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109671","aliases":["CVE-2026-109671"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.3,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.113.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.24.0","versionType":"semver"},{"status":"unaffected","version":"15.113.0","versionType":"semver"},{"status":"unaffected","version":"16.24.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:35:57.389Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rg9g-c26v-cw27","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.113.0-stored-xss-via-profile-field-in-portal-pages"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109671","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:34:27.562780Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:35:57.389Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.142Z"}}},"related_cves":[{"value":"CVE-2026-109671","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109671","advisory_id":"3395fb82-2ec4-453a-a43b-0fb5c95b8f2c","event_types":["advisory"],"published_at":"2026-10-25T07:48:59.07569+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.142+00:00","detail_url":"/events/28824"}]}},{"id":29042,"cve_ids":["CVE-2026-109666"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109666","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109666","aliases":["CVE-2026-109666"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:33:53.402Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6rgf-xx2m-fjr2","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-inventory-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:33:09.927396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:33:53.402Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.901Z"}}},"related_cves":[{"value":"CVE-2026-109666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02f896ee-14ff-4a74-b5ed-199375d46f8f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109666","advisory_id":"02f896ee-14ff-4a74-b5ed-199375d46f8f","event_types":["advisory"],"published_at":"2026-10-25T07:48:53.174984+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.901+00:00","detail_url":"/advisories/advisory%3A02f896ee-14ff-4a74-b5ed-199375d46f8f","group":{"id":"advisory:02f896ee-14ff-4a74-b5ed-199375d46f8f","revision":1,"primary_event_id":28814,"change":"published","superseded_by":[],"changed":{"id":28814,"cve_ids":["CVE-2026-109666"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109666","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109666","aliases":["CVE-2026-109666"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:33:53.402Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6rgf-xx2m-fjr2","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-inventory-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:33:09.927396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:33:53.402Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.901Z"}}},"related_cves":[{"value":"CVE-2026-109666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02f896ee-14ff-4a74-b5ed-199375d46f8f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109666","advisory_id":"02f896ee-14ff-4a74-b5ed-199375d46f8f","event_types":["advisory"],"published_at":"2026-10-25T07:48:53.174984+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.901+00:00","detail_url":"/events/28814"},"members":[{"id":28814,"cve_ids":["CVE-2026-109666"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109666","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109666","aliases":["CVE-2026-109666"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:33:53.402Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6rgf-xx2m-fjr2","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-inventory-record-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109666","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:33:09.927396Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:33:53.402Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:32.901Z"}}},"related_cves":[{"value":"CVE-2026-109666","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02f896ee-14ff-4a74-b5ed-199375d46f8f","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109666","advisory_id":"02f896ee-14ff-4a74-b5ed-199375d46f8f","event_types":["advisory"],"published_at":"2026-10-25T07:48:53.174984+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:32.901+00:00","detail_url":"/events/28814"}]}},{"id":29041,"cve_ids":["CVE-2026-109661"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109661","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109661","aliases":["CVE-2026-109661"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.116.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.116.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:32:33.162Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j2h8-8xqj-jrg9","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.116.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:32:15.726937Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:32:33.162Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:29.645Z"}}},"related_cves":[{"value":"CVE-2026-109661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4f14cd5f-bdb4-4805-9a86-d957c9877fd3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109661","advisory_id":"4f14cd5f-bdb4-4805-9a86-d957c9877fd3","event_types":["advisory"],"published_at":"2026-10-25T07:48:52.603282+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:29.645+00:00","detail_url":"/advisories/advisory%3A4f14cd5f-bdb4-4805-9a86-d957c9877fd3","group":{"id":"advisory:4f14cd5f-bdb4-4805-9a86-d957c9877fd3","revision":1,"primary_event_id":28813,"change":"published","superseded_by":[],"changed":{"id":28813,"cve_ids":["CVE-2026-109661"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109661","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109661","aliases":["CVE-2026-109661"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.116.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.116.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:32:33.162Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j2h8-8xqj-jrg9","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.116.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:32:15.726937Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:32:33.162Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:29.645Z"}}},"related_cves":[{"value":"CVE-2026-109661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4f14cd5f-bdb4-4805-9a86-d957c9877fd3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109661","advisory_id":"4f14cd5f-bdb4-4805-9a86-d957c9877fd3","event_types":["advisory"],"published_at":"2026-10-25T07:48:52.603282+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:29.645+00:00","detail_url":"/events/28813"},"members":[{"id":28813,"cve_ids":["CVE-2026-109661"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109661","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109661","aliases":["CVE-2026-109661"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.116.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.116.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:32:33.162Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-j2h8-8xqj-jrg9","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.116.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109661","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:32:15.726937Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:32:33.162Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:29.645Z"}}},"related_cves":[{"value":"CVE-2026-109661","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:4f14cd5f-bdb4-4805-9a86-d957c9877fd3","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109661","advisory_id":"4f14cd5f-bdb4-4805-9a86-d957c9877fd3","event_types":["advisory"],"published_at":"2026-10-25T07:48:52.603282+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:29.645+00:00","detail_url":"/events/28813"}]}},{"id":29040,"cve_ids":["CVE-2026-109651"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.","evidence":"cve:CVE-2026-109651","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109651","aliases":["CVE-2026-109651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:30:30.540Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6qcc-cw7f-328g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-server-side-request-forgery-via-configuration-field"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109651","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:30:00.581746Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:30:30.540Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:23.264Z"}}},"related_cves":[{"value":"CVE-2026-109651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109651","advisory_id":"0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.827709+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:23.264+00:00","detail_url":"/advisories/advisory%3A0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","group":{"id":"advisory:0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","revision":1,"primary_event_id":28812,"change":"published","superseded_by":[],"changed":{"id":28812,"cve_ids":["CVE-2026-109651"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.","evidence":"cve:CVE-2026-109651","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109651","aliases":["CVE-2026-109651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:30:30.540Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6qcc-cw7f-328g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-server-side-request-forgery-via-configuration-field"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109651","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:30:00.581746Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:30:30.540Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:23.264Z"}}},"related_cves":[{"value":"CVE-2026-109651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109651","advisory_id":"0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.827709+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:23.264+00:00","detail_url":"/events/28812"},"members":[{"id":28812,"cve_ids":["CVE-2026-109651"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field","summary":"Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network.","evidence":"cve:CVE-2026-109651","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109651","aliases":["CVE-2026-109651"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.112.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.112.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:30:30.540Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-6qcc-cw7f-328g","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.112.0-server-side-request-forgery-via-configuration-field"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109651","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:30:00.581746Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:30:30.540Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:23.264Z"}}},"related_cves":[{"value":"CVE-2026-109651","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109651","advisory_id":"0253e19d-4d86-42e0-bfa1-fbbf9ed8b96c","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.827709+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:23.264+00:00","detail_url":"/events/28812"}]}},{"id":29039,"cve_ids":["CVE-2026-109656"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access","summary":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.","evidence":"cve:CVE-2026-109656","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109656","aliases":["CVE-2026-109656"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.2","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.30.0","versionType":"semver"},{"status":"unaffected","version":"15.118.2","versionType":"semver"},{"status":"unaffected","version":"16.30.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:31:39.144Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-4j82-w8f7-hqqp","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.2-unauthorized-item-master-data-access"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109656","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:31:18.407394Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:31:39.144Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:26.493Z"}}},"related_cves":[{"value":"CVE-2026-109656","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7372d108-ce50-41cf-9f0b-0af90c7abf83","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109656","advisory_id":"7372d108-ce50-41cf-9f0b-0af90c7abf83","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.253339+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:26.493+00:00","detail_url":"/advisories/advisory%3A7372d108-ce50-41cf-9f0b-0af90c7abf83","group":{"id":"advisory:7372d108-ce50-41cf-9f0b-0af90c7abf83","revision":1,"primary_event_id":28811,"change":"published","superseded_by":[],"changed":{"id":28811,"cve_ids":["CVE-2026-109656"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access","summary":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.","evidence":"cve:CVE-2026-109656","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109656","aliases":["CVE-2026-109656"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.2","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.30.0","versionType":"semver"},{"status":"unaffected","version":"15.118.2","versionType":"semver"},{"status":"unaffected","version":"16.30.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:31:39.144Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-4j82-w8f7-hqqp","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.2-unauthorized-item-master-data-access"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109656","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:31:18.407394Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:31:39.144Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:26.493Z"}}},"related_cves":[{"value":"CVE-2026-109656","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7372d108-ce50-41cf-9f0b-0af90c7abf83","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109656","advisory_id":"7372d108-ce50-41cf-9f0b-0af90c7abf83","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.253339+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:26.493+00:00","detail_url":"/events/28811"},"members":[{"id":28811,"cve_ids":["CVE-2026-109656"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access","summary":"Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.","evidence":"cve:CVE-2026-109656","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109656","aliases":["CVE-2026-109656"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.2","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.30.0","versionType":"semver"},{"status":"unaffected","version":"15.118.2","versionType":"semver"},{"status":"unaffected","version":"16.30.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:31:39.144Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-4j82-w8f7-hqqp","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.2-unauthorized-item-master-data-access"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109656","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:31:18.407394Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:31:39.144Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:26.493Z"}}},"related_cves":[{"value":"CVE-2026-109656","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:7372d108-ce50-41cf-9f0b-0af90c7abf83","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109656","advisory_id":"7372d108-ce50-41cf-9f0b-0af90c7abf83","event_types":["advisory"],"published_at":"2026-10-25T07:48:51.253339+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:26.493+00:00","detail_url":"/events/28811"}]}},{"id":29038,"cve_ids":["CVE-2026-109646"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109646","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109646","aliases":["CVE-2026-109646"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.106.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.16.0","versionType":"semver"},{"status":"unaffected","version":"15.106.0","versionType":"semver"},{"status":"unaffected","version":"16.16.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:28:41.810Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pf6r-r324-94jj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.106.0-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109646","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:28:25.631075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:28:41.810Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.988Z"}}},"related_cves":[{"value":"CVE-2026-109646","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109646","advisory_id":"0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","event_types":["advisory"],"published_at":"2026-10-25T07:48:50.479042+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.988+00:00","detail_url":"/advisories/advisory%3A0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","group":{"id":"advisory:0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","revision":1,"primary_event_id":28810,"change":"published","superseded_by":[],"changed":{"id":28810,"cve_ids":["CVE-2026-109646"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109646","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109646","aliases":["CVE-2026-109646"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.106.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.16.0","versionType":"semver"},{"status":"unaffected","version":"15.106.0","versionType":"semver"},{"status":"unaffected","version":"16.16.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:28:41.810Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pf6r-r324-94jj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.106.0-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109646","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:28:25.631075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:28:41.810Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.988Z"}}},"related_cves":[{"value":"CVE-2026-109646","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109646","advisory_id":"0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","event_types":["advisory"],"published_at":"2026-10-25T07:48:50.479042+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.988+00:00","detail_url":"/events/28810"},"members":[{"id":28810,"cve_ids":["CVE-2026-109646"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109646","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109646","aliases":["CVE-2026-109646"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.106.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.16.0","versionType":"semver"},{"status":"unaffected","version":"15.106.0","versionType":"semver"},{"status":"unaffected","version":"16.16.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:28:41.810Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-pf6r-r324-94jj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.106.0-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109646","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:28:25.631075Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:28:41.810Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:19.988Z"}}},"related_cves":[{"value":"CVE-2026-109646","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109646","advisory_id":"0f6ef0d1-7d8b-4c61-82eb-8fbf8eaf30f2","event_types":["advisory"],"published_at":"2026-10-25T07:48:50.479042+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:19.988+00:00","detail_url":"/events/28810"}]}},{"id":29037,"cve_ids":["CVE-2026-109641"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.","evidence":"cve:CVE-2026-109641","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109641","aliases":["CVE-2026-109641"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:27:11.351Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-38rx-wm3g-39m3","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109641","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:26:55.845489Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:27:11.351Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.788Z"}}},"related_cves":[{"value":"CVE-2026-109641","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2bdecb4-3963-4898-ad69-18cf9e5026cb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109641","advisory_id":"e2bdecb4-3963-4898-ad69-18cf9e5026cb","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.740456+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.788+00:00","detail_url":"/advisories/advisory%3Ae2bdecb4-3963-4898-ad69-18cf9e5026cb","group":{"id":"advisory:e2bdecb4-3963-4898-ad69-18cf9e5026cb","revision":1,"primary_event_id":28809,"change":"published","superseded_by":[],"changed":{"id":28809,"cve_ids":["CVE-2026-109641"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.","evidence":"cve:CVE-2026-109641","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109641","aliases":["CVE-2026-109641"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:27:11.351Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-38rx-wm3g-39m3","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109641","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:26:55.845489Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:27:11.351Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.788Z"}}},"related_cves":[{"value":"CVE-2026-109641","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2bdecb4-3963-4898-ad69-18cf9e5026cb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109641","advisory_id":"e2bdecb4-3963-4898-ad69-18cf9e5026cb","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.740456+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.788+00:00","detail_url":"/events/28809"},"members":[{"id":28809,"cve_ids":["CVE-2026-109641"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints","summary":"Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.","evidence":"cve:CVE-2026-109641","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109641","aliases":["CVE-2026-109641"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"LOW","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"NONE","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.110.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.21.0","versionType":"semver"},{"status":"unaffected","version":"15.110.0","versionType":"semver"},{"status":"unaffected","version":"16.21.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:27:11.351Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-38rx-wm3g-39m3","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-record-creation-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109641","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:26:55.845489Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:27:11.351Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:16.788Z"}}},"related_cves":[{"value":"CVE-2026-109641","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e2bdecb4-3963-4898-ad69-18cf9e5026cb","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109641","advisory_id":"e2bdecb4-3963-4898-ad69-18cf9e5026cb","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.740456+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:16.788+00:00","detail_url":"/events/28809"}]}},{"id":29036,"cve_ids":["CVE-2026-109636"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109636","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109636","aliases":["CVE-2026-109636"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:25:39.100Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-g72f-g9wf-42vr","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109636","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:25:21.322513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:25:39.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:13.529Z"}}},"related_cves":[{"value":"CVE-2026-109636","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02d8490a-39b7-44f7-a263-62d35da64e0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109636","advisory_id":"02d8490a-39b7-44f7-a263-62d35da64e0d","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.163266+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:13.529+00:00","detail_url":"/advisories/advisory%3A02d8490a-39b7-44f7-a263-62d35da64e0d","group":{"id":"advisory:02d8490a-39b7-44f7-a263-62d35da64e0d","revision":1,"primary_event_id":28808,"change":"published","superseded_by":[],"changed":{"id":28808,"cve_ids":["CVE-2026-109636"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109636","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109636","aliases":["CVE-2026-109636"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:25:39.100Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-g72f-g9wf-42vr","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109636","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:25:21.322513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:25:39.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:13.529Z"}}},"related_cves":[{"value":"CVE-2026-109636","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02d8490a-39b7-44f7-a263-62d35da64e0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109636","advisory_id":"02d8490a-39b7-44f7-a263-62d35da64e0d","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.163266+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:13.529+00:00","detail_url":"/events/28808"},"members":[{"id":28808,"cve_ids":["CVE-2026-109636"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond their permitted role.","evidence":"cve:CVE-2026-109636","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109636","aliases":["CVE-2026-109636"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.115.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.26.0","versionType":"semver"},{"status":"unaffected","version":"15.115.0","versionType":"semver"},{"status":"unaffected","version":"16.26.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:25:39.100Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-g72f-g9wf-42vr","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109636","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:25:21.322513Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:25:39.100Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:13.529Z"}}},"related_cves":[{"value":"CVE-2026-109636","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:02d8490a-39b7-44f7-a263-62d35da64e0d","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109636","advisory_id":"02d8490a-39b7-44f7-a263-62d35da64e0d","event_types":["advisory"],"published_at":"2026-10-25T07:48:49.163266+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:13.529+00:00","detail_url":"/events/28808"}]}},{"id":29017,"cve_ids":["CVE-2026-109631"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.","evidence":"cve:CVE-2026-109631","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109631","aliases":["CVE-2026-109631"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.1","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.32.0","versionType":"semver"},{"status":"unaffected","version":"15.119.1","versionType":"semver"},{"status":"unaffected","version":"16.32.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:15:27.814Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-jp5q-723q-g826","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109631","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:15:09.078595Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:15:27.814Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:10.282Z"}}},"related_cves":[{"value":"CVE-2026-109631","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6a63756-0d32-4b89-b4d3-6d6a16abed18","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109631","advisory_id":"a6a63756-0d32-4b89-b4d3-6d6a16abed18","event_types":["advisory"],"published_at":"2026-10-25T07:48:38.39619+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:10.282+00:00","detail_url":"/advisories/advisory%3Aa6a63756-0d32-4b89-b4d3-6d6a16abed18","group":{"id":"advisory:a6a63756-0d32-4b89-b4d3-6d6a16abed18","revision":1,"primary_event_id":28791,"change":"published","superseded_by":[],"changed":{"id":28791,"cve_ids":["CVE-2026-109631"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.","evidence":"cve:CVE-2026-109631","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109631","aliases":["CVE-2026-109631"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.1","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.32.0","versionType":"semver"},{"status":"unaffected","version":"15.119.1","versionType":"semver"},{"status":"unaffected","version":"16.32.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:15:27.814Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-jp5q-723q-g826","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109631","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:15:09.078595Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:15:27.814Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:10.282Z"}}},"related_cves":[{"value":"CVE-2026-109631","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6a63756-0d32-4b89-b4d3-6d6a16abed18","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109631","advisory_id":"a6a63756-0d32-4b89-b4d3-6d6a16abed18","event_types":["advisory"],"published_at":"2026-10-25T07:48:38.39619+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:10.282+00:00","detail_url":"/events/28791"},"members":[{"id":28791,"cve_ids":["CVE-2026-109631"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation","summary":"Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.","evidence":"cve:CVE-2026-109631","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109631","aliases":["CVE-2026-109631"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.119.1","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.32.0","versionType":"semver"},{"status":"unaffected","version":"15.119.1","versionType":"semver"},{"status":"unaffected","version":"16.32.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:15:27.814Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-jp5q-723q-g826","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.119.1-sql-injection-via-missing-validation"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109631","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:15:09.078595Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:15:27.814Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:10.282Z"}}},"related_cves":[{"value":"CVE-2026-109631","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:a6a63756-0d32-4b89-b4d3-6d6a16abed18","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109631","advisory_id":"a6a63756-0d32-4b89-b4d3-6d6a16abed18","event_types":["advisory"],"published_at":"2026-10-25T07:48:38.39619+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:10.282+00:00","detail_url":"/events/28791"}]}},{"id":29016,"cve_ids":["CVE-2026-109626"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints","summary":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109626","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109626","aliases":["CVE-2026-109626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.34.2","versionType":"semver"},{"status":"unaffected","version":"16.34.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:13:30.424Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-mp29-fjc5-h86p","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.2-sql-injection-via-multiple-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:12:41.422502Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:13:30.424Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:07.020Z"}}},"related_cves":[{"value":"CVE-2026-109626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:171147cc-7918-4728-b0b1-b3f985da9444","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109626","advisory_id":"171147cc-7918-4728-b0b1-b3f985da9444","event_types":["advisory"],"published_at":"2026-10-25T07:48:37.551235+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:07.02+00:00","detail_url":"/advisories/advisory%3A171147cc-7918-4728-b0b1-b3f985da9444","group":{"id":"advisory:171147cc-7918-4728-b0b1-b3f985da9444","revision":1,"primary_event_id":28790,"change":"published","superseded_by":[],"changed":{"id":28790,"cve_ids":["CVE-2026-109626"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints","summary":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109626","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109626","aliases":["CVE-2026-109626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.34.2","versionType":"semver"},{"status":"unaffected","version":"16.34.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:13:30.424Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-mp29-fjc5-h86p","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.2-sql-injection-via-multiple-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:12:41.422502Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:13:30.424Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:07.020Z"}}},"related_cves":[{"value":"CVE-2026-109626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:171147cc-7918-4728-b0b1-b3f985da9444","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109626","advisory_id":"171147cc-7918-4728-b0b1-b3f985da9444","event_types":["advisory"],"published_at":"2026-10-25T07:48:37.551235+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:07.02+00:00","detail_url":"/events/28790"},"members":[{"id":28790,"cve_ids":["CVE-2026-109626"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints","summary":"Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.","evidence":"cve:CVE-2026-109626","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109626","aliases":["CVE-2026-109626"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"16.34.2","versionType":"semver"},{"status":"unaffected","version":"16.34.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:13:30.424Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-mp29-fjc5-h86p","https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.2-sql-injection-via-multiple-endpoints"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109626","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:12:41.422502Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:13:30.424Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:07.020Z"}}},"related_cves":[{"value":"CVE-2026-109626","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:171147cc-7918-4728-b0b1-b3f985da9444","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109626","advisory_id":"171147cc-7918-4728-b0b1-b3f985da9444","event_types":["advisory"],"published_at":"2026-10-25T07:48:37.551235+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:07.02+00:00","detail_url":"/events/28790"}]}},{"id":29015,"cve_ids":["CVE-2026-109621"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.","evidence":"cve:CVE-2026-109621","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109621","aliases":["CVE-2026-109621"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:11:57.787Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wwgm-3pv3-gmqh","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-unauthorized-party-record-access-via-permission-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109621","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:11:46.595812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:11:57.787Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.717Z"}}},"related_cves":[{"value":"CVE-2026-109621","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d65888e-211e-4df1-bc6f-776fd8a691d6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109621","advisory_id":"0d65888e-211e-4df1-bc6f-776fd8a691d6","event_types":["advisory"],"published_at":"2026-10-25T07:48:36.683517+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.717+00:00","detail_url":"/advisories/advisory%3A0d65888e-211e-4df1-bc6f-776fd8a691d6","group":{"id":"advisory:0d65888e-211e-4df1-bc6f-776fd8a691d6","revision":1,"primary_event_id":28789,"change":"published","superseded_by":[],"changed":{"id":28789,"cve_ids":["CVE-2026-109621"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.","evidence":"cve:CVE-2026-109621","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109621","aliases":["CVE-2026-109621"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:11:57.787Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wwgm-3pv3-gmqh","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-unauthorized-party-record-access-via-permission-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109621","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:11:46.595812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:11:57.787Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.717Z"}}},"related_cves":[{"value":"CVE-2026-109621","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d65888e-211e-4df1-bc6f-776fd8a691d6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109621","advisory_id":"0d65888e-211e-4df1-bc6f-776fd8a691d6","event_types":["advisory"],"published_at":"2026-10-25T07:48:36.683517+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.717+00:00","detail_url":"/events/28789"},"members":[{"id":28789,"cve_ids":["CVE-2026-109621"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass","summary":"Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.","evidence":"cve:CVE-2026-109621","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109621","aliases":["CVE-2026-109621"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.120.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.23.0","versionType":"semver"},{"status":"unaffected","version":"15.120.0","versionType":"semver"},{"status":"unaffected","version":"16.23.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:11:57.787Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wwgm-3pv3-gmqh","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.120.0-unauthorized-party-record-access-via-permission-bypass"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109621","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:11:46.595812Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:11:57.787Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:03.717Z"}}},"related_cves":[{"value":"CVE-2026-109621","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:0d65888e-211e-4df1-bc6f-776fd8a691d6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109621","advisory_id":"0d65888e-211e-4df1-bc6f-776fd8a691d6","event_types":["advisory"],"published_at":"2026-10-25T07:48:36.683517+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:03.717+00:00","detail_url":"/events/28789"}]}},{"id":29014,"cve_ids":["CVE-2026-109613"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109613","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109613","aliases":["CVE-2026-109613"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:10:00.827Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wp9w-rxmg-6pfj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-allows-unauthorized-status-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109613","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:09:49.446482Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:10:00.827Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:00.386Z"}}},"related_cves":[{"value":"CVE-2026-109613","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51d890aa-f83a-4dbf-beac-7223fb2099c6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109613","advisory_id":"51d890aa-f83a-4dbf-beac-7223fb2099c6","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.825485+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:00.386+00:00","detail_url":"/advisories/advisory%3A51d890aa-f83a-4dbf-beac-7223fb2099c6","group":{"id":"advisory:51d890aa-f83a-4dbf-beac-7223fb2099c6","revision":1,"primary_event_id":28788,"change":"published","superseded_by":[],"changed":{"id":28788,"cve_ids":["CVE-2026-109613"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109613","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109613","aliases":["CVE-2026-109613"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:10:00.827Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wp9w-rxmg-6pfj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-allows-unauthorized-status-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109613","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:09:49.446482Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:10:00.827Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:00.386Z"}}},"related_cves":[{"value":"CVE-2026-109613","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51d890aa-f83a-4dbf-beac-7223fb2099c6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109613","advisory_id":"51d890aa-f83a-4dbf-beac-7223fb2099c6","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.825485+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:00.386+00:00","detail_url":"/events/28788"},"members":[{"id":28788,"cve_ids":["CVE-2026-109613"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on document status modification. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted role, bypassing intended role-based access restrictions.","evidence":"cve:CVE-2026-109613","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109613","aliases":["CVE-2026-109613"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"LOW","privilegesRequired":"LOW","confidentialityImpact":"NONE"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:10:00.827Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-wp9w-rxmg-6pfj","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-allows-unauthorized-status-modification"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109613","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T14:09:49.446482Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:10:00.827Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:00.386Z"}}},"related_cves":[{"value":"CVE-2026-109613","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:51d890aa-f83a-4dbf-beac-7223fb2099c6","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109613","advisory_id":"51d890aa-f83a-4dbf-beac-7223fb2099c6","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.825485+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:00.386+00:00","detail_url":"/events/28788"}]}},{"id":29013,"cve_ids":["CVE-2026-109608"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","evidence":"cve:CVE-2026-109608","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109608","aliases":["CVE-2026-109608"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:09:06.332Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-sql-injection-via-unvalidated-endpoint-input"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109608","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:08:49.170748Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:09:06.332Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:57.198Z"}}},"related_cves":[{"value":"CVE-2026-109608","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:61760927-2691-4289-bc62-3e06eaeede17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109608","advisory_id":"61760927-2691-4289-bc62-3e06eaeede17","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.199614+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:57.198+00:00","detail_url":"/advisories/advisory%3A61760927-2691-4289-bc62-3e06eaeede17","group":{"id":"advisory:61760927-2691-4289-bc62-3e06eaeede17","revision":1,"primary_event_id":28787,"change":"published","superseded_by":[],"changed":{"id":28787,"cve_ids":["CVE-2026-109608"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","evidence":"cve:CVE-2026-109608","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109608","aliases":["CVE-2026-109608"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:09:06.332Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-sql-injection-via-unvalidated-endpoint-input"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109608","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:08:49.170748Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:09:06.332Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:57.198Z"}}},"related_cves":[{"value":"CVE-2026-109608","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:61760927-2691-4289-bc62-3e06eaeede17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109608","advisory_id":"61760927-2691-4289-bc62-3e06eaeede17","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.199614+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:57.198+00:00","detail_url":"/events/28787"},"members":[{"id":28787,"cve_ids":["CVE-2026-109608"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input","summary":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","evidence":"cve:CVE-2026-109608","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109608","aliases":["CVE-2026-109608"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":8.7,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":8.8,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.121.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.34.0","versionType":"semver"},{"status":"unaffected","version":"15.121.0","versionType":"semver"},{"status":"unaffected","version":"16.34.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-15T14:09:06.332Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-sql-injection-via-unvalidated-endpoint-input"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109608","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T14:08:49.170748Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T14:09:06.332Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:21:57.198Z"}}},"related_cves":[{"value":"CVE-2026-109608","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:61760927-2691-4289-bc62-3e06eaeede17","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109608","advisory_id":"61760927-2691-4289-bc62-3e06eaeede17","event_types":["advisory"],"published_at":"2026-10-25T07:48:35.199614+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:21:57.198+00:00","detail_url":"/events/28787"}]}},{"id":28976,"cve_ids":["CVE-2026-109377"],"payload":{"kind":"advisory","title":"ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods","summary":"ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.","evidence":"cve:CVE-2026-109377","products":[{"name":{"value":"ERPNext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109377","aliases":["CVE-2026-109377"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/frappe/erpnext","vendor":"Frappe","product":"ERPNext","versions":[{"status":"affected","version":"9.0.0","versionType":"semver","lessThanOrEqual":"16.50.0"}],"packageURL":"pkg:github/frappe/erpnext","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:51:52.605Z","provider":"cve","references":["https://github.com/frappe/erpnext/pull/60147","https://github.com/frappe/erpnext/commit/10a2400312afd17df740c6ed64e0803dfbabb623","https://github.com/frappe/erpnext/blob/v16.50.0/erpnext/stock/doctype/batch/batch.py#L235-L301","https://github.com/frappe/erpnext","https://www.vulncheck.com/advisories/erpnext-9.0.0-through-16.50.0-missing-authorization-in-batch-lookup-methods"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109377","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:51:41.864216Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:51:52.605Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T20:55:09.844Z"}}},"related_cves":[{"value":"CVE-2026-109377","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd04521-b9ec-40ab-95c4-02fecc4de515","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109377","advisory_id":"cfd04521-b9ec-40ab-95c4-02fecc4de515","event_types":["advisory"],"published_at":"2026-10-25T07:47:31.133494+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T20:55:09.844+00:00","detail_url":"/advisories/advisory%3Acfd04521-b9ec-40ab-95c4-02fecc4de515","group":{"id":"advisory:cfd04521-b9ec-40ab-95c4-02fecc4de515","revision":1,"primary_event_id":28750,"change":"published","superseded_by":[],"changed":{"id":28750,"cve_ids":["CVE-2026-109377"],"payload":{"kind":"advisory","title":"ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods","summary":"ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.","evidence":"cve:CVE-2026-109377","products":[{"name":{"value":"ERPNext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109377","aliases":["CVE-2026-109377"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/frappe/erpnext","vendor":"Frappe","product":"ERPNext","versions":[{"status":"affected","version":"9.0.0","versionType":"semver","lessThanOrEqual":"16.50.0"}],"packageURL":"pkg:github/frappe/erpnext","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:51:52.605Z","provider":"cve","references":["https://github.com/frappe/erpnext/pull/60147","https://github.com/frappe/erpnext/commit/10a2400312afd17df740c6ed64e0803dfbabb623","https://github.com/frappe/erpnext/blob/v16.50.0/erpnext/stock/doctype/batch/batch.py#L235-L301","https://github.com/frappe/erpnext","https://www.vulncheck.com/advisories/erpnext-9.0.0-through-16.50.0-missing-authorization-in-batch-lookup-methods"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109377","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:51:41.864216Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:51:52.605Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T20:55:09.844Z"}}},"related_cves":[{"value":"CVE-2026-109377","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd04521-b9ec-40ab-95c4-02fecc4de515","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109377","advisory_id":"cfd04521-b9ec-40ab-95c4-02fecc4de515","event_types":["advisory"],"published_at":"2026-10-25T07:47:31.133494+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T20:55:09.844+00:00","detail_url":"/events/28750"},"members":[{"id":28750,"cve_ids":["CVE-2026-109377"],"payload":{"kind":"advisory","title":"ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods","summary":"ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.","evidence":"cve:CVE-2026-109377","products":[{"name":{"value":"ERPNext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-109377","aliases":["CVE-2026-109377"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":5.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"LOW"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}}],"affected":[{"repo":"https://github.com/frappe/erpnext","vendor":"Frappe","product":"ERPNext","versions":[{"status":"affected","version":"9.0.0","versionType":"semver","lessThanOrEqual":"16.50.0"}],"packageURL":"pkg:github/frappe/erpnext","defaultStatus":"unaffected"}],"modified":"2026-10-15T13:51:52.605Z","provider":"cve","references":["https://github.com/frappe/erpnext/pull/60147","https://github.com/frappe/erpnext/commit/10a2400312afd17df740c6ed64e0803dfbabb623","https://github.com/frappe/erpnext/blob/v16.50.0/erpnext/stock/doctype/batch/batch.py#L235-L301","https://github.com/frappe/erpnext","https://www.vulncheck.com/advisories/erpnext-9.0.0-through-16.50.0-missing-authorization-in-batch-lookup-methods"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109377","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-15T13:51:41.864216Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-15T13:51:52.605Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T20:55:09.844Z"}}},"related_cves":[{"value":"CVE-2026-109377","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:cfd04521-b9ec-40ab-95c4-02fecc4de515","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109377","advisory_id":"cfd04521-b9ec-40ab-95c4-02fecc4de515","event_types":["advisory"],"published_at":"2026-10-25T07:47:31.133494+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T20:55:09.844+00:00","detail_url":"/events/28750"}]}},{"id":22104,"cve_ids":["CVE-2026-109672"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109672","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109672","aliases":["CVE-2026-109672"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.118.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T13:56:50.572Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109672","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T13:54:57.825135Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T13:56:50.572Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.829Z"}}},"related_cves":[{"value":"CVE-2026-109672","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7a60e17-7e24-4e1b-965a-f46959931691","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109672","advisory_id":"e7a60e17-7e24-4e1b-965a-f46959931691","event_types":["advisory"],"published_at":"2026-10-25T05:53:47.848689+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.829+00:00","detail_url":"/advisories/advisory%3Ae7a60e17-7e24-4e1b-965a-f46959931691","group":{"id":"advisory:e7a60e17-7e24-4e1b-965a-f46959931691","revision":1,"primary_event_id":21947,"change":"published","superseded_by":[],"changed":{"id":21947,"cve_ids":["CVE-2026-109672"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109672","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109672","aliases":["CVE-2026-109672"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.118.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T13:56:50.572Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109672","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T13:54:57.825135Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T13:56:50.572Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.829Z"}}},"related_cves":[{"value":"CVE-2026-109672","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7a60e17-7e24-4e1b-965a-f46959931691","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109672","advisory_id":"e7a60e17-7e24-4e1b-965a-f46959931691","event_types":["advisory"],"published_at":"2026-10-25T05:53:47.848689+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.829+00:00","detail_url":"/events/21947"},"members":[{"id":21947,"cve_ids":["CVE-2026-109672"],"payload":{"kind":"advisory","title":"Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data","summary":"Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits.","evidence":"cve:CVE-2026-109672","products":[{"name":{"value":"erpnext","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-109672","aliases":["CVE-2026-109672"],"metrics":[{"format":"CVSS","cvssV4_0":{"version":"4.0","baseScore":7.1,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}},{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"HIGH"}}],"affected":[{"vendor":"frappe","product":"erpnext","versions":[{"status":"affected","version":"0","lessThan":"15.118.0","versionType":"semver"},{"status":"affected","version":"16.0.0-beta.1","lessThan":"16.27.0","versionType":"semver"},{"status":"unaffected","version":"15.118.0","versionType":"semver"},{"status":"unaffected","version":"16.27.0","versionType":"semver"}],"defaultStatus":"unaffected"}],"modified":"2026-10-14T13:56:50.572Z","provider":"cve","references":["https://github.com/frappe/erpnext/security/advisories/GHSA-rgrq-243c-c4g6","https://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.0-missing-authorization-exposes-financial-data"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-109672","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-14T13:54:57.825135Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-14T13:56:50.572Z"}}],"cna":{"orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","shortName":"VulnCheck","dateUpdated":"2026-10-12T22:22:36.829Z"}}},"related_cves":[{"value":"CVE-2026-109672","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:e7a60e17-7e24-4e1b-965a-f46959931691","priority":{"reasons":["publisher_severity"],"severity":"high","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109672","advisory_id":"e7a60e17-7e24-4e1b-965a-f46959931691","event_types":["advisory"],"published_at":"2026-10-25T05:53:47.848689+00:00","technologies":["core-cve","erpnext"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-12T22:22:36.829+00:00","detail_url":"/events/21947"}]}}],"next_after":42219,"next_before":22104}