---
id: CVE-2026-109614
title: >-
  Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability
  that allows authenticated users to read financial data beyond their permitted
  role
summary: >-
  Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability
  that allows authenticated users to read financial data beyond their permitted
  role. Attackers can query endpoints lacking proper authorization checks to
  access …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-862
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:25.643'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109614'
references:
  - url: 'https://github.com/frappe/erpnext/security/advisories/GHSA-qcff-6669-j3gj'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-erpnext-before-16.34.0-missing-authorization-exposes-financial-data
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.619Z'
---

## Overview

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.