---
id: CVE-2026-109637
title: >-
  Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability
  that allows authenticated users to modify master data beyond their permitted
  role
summary: >-
  Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability
  that allows authenticated users to modify master data beyond their permitted
  role. Attackers can send requests to certain endpoints lacking proper
  authorization…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-862
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:29.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109637'
references:
  - url: 'https://github.com/frappe/erpnext/security/advisories/GHSA-fwgg-5fp9-rg78'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-erpnext-before-16.14.0-missing-authorization-allows-master-data-modification
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.626Z'
---

## Overview

Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.