Frappe ERPNext: Privilege escalation via unauthorized record creation
Summary
An endpoint in Frappe ERPNext takes the record type from the request and inserts the record without permission checks. Any authenticated user, including one without an operational role, can create privileged accounts and take full control of the site. Because ERPNext holds financial and customer data, a takeover has a high impact. The attacker needs only a valid login, so exposure depends on who can log in, including self-registration or portal users.
Affected
- ERPNext before 15.111.0
- ERPNext 16.0.0-beta.1 up to before 16.22.0
Fixed in
- 15.111.0
- 16.22.0
Workaround
- The vendor states that no workaround is available and that upgrading is required.
- Restricting access to the ERP to trusted internal networks reduces exposure but does not fix the flaw.
Exploitation
Unknown. No evidence of exploitation in the wild was found, and no CISA KEV listing was found. CISA SSVC lists exploitation as none and automatable as no. No public proof of concept was found.
Our recommendation
- Identify all ERPNext/Frappe instances and their versions, including hosted or Frappe Cloud deployments.
- Upgrade to 15.111.0 or 16.22.0 at minimum. Prefer the latest patch release, because CVE-2026-109652 is fixed only in 15.119.1 and 16.32.0.
- Check user accounts and role assignments for unexpected privileged accounts, and review logs for unexpected user creation.
- Limit internet access to the ERP and disable self-registration if it is not needed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-x635-wr4c-7345 github.com
- VulnCheck advisory: Frappe ERPNext before 15.111.0 www.vulncheck.com
- OSV: CVE-2026-109667 osv.dev
- VulDB: CVE-2026-109667 vuldb.com
- ThreatINT: CVE-2026-109667 cve.threatint.com
- VulnCheck advisory: ERPNext before 15.119.1 server-side template injection www.vulncheck.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:38.
Original description (NVD)
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.