CVE-2026-109617 is a High severity (CVSS 7.1) missing authorization flaw in Frappe ERPNext. Certain endpoints do not check permissions when a document is created, so a low-privileged user can create records outside their role. Upgrade to 15.121.0 on the 15 line or 16.34.0 on the 16 line.
What's affected
The record says ERPNext before 15.121.0, and 16.x before 16.34.0, are affected. The GitHub advisory from the Frappe project agrees: affected versions are anything below 15.121.0 and anything below 16.34.0, with 15.121.0 and 16.34.0 listed as patched. The weakness is CWE-862, missing authorization.
The advisory describes the impact in one sentence. Certain endpoints failed to enforce proper authorization checks, which let users create documents against records beyond their permitted role. It names no workaround and says upgrading is required.
Severity differs between sources. The record and VulnCheck give 7.1 (High). The GitHub advisory shows a CVSS v3 score of 8.5 (High) because it marks scope as changed. Both are High, so the response is the same: patch.
How to check if you're exposed
ERPNext is usually installed through the Frappe bench. From your bench directory, list the installed app versions.
bench version
If erpnext reports a version below 15.121.0 on the 15 line, or below 16.34.0 on the 16 line, you are in range. If you run a hosted ERPNext service, ask the provider which version it runs and when it was upgraded.
Exposure also depends on who can log in. The flaw needs an authenticated user, so a site where every account is a trusted employee carries less risk than one that lets customers, suppliers or contractors sign in. Review which roles exist and who holds them. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Run bench version and record the erpnext version on every site and bench you manage.
- Upgrade to 15.121.0 or later on the 15 line, or 16.34.0 or later on the 16 line, using your normal bench update process after taking a backup.
- Review recently created documents for records made by accounts that should not have been able to create them, such as users with read-only or limited roles.
- Reduce the number of accounts with portal or low-privilege access that you no longer need.
- Subscribe to the Frappe security advisories so the next one reaches you on the day it is published.
Why it matters
Missing authorization is one of the most common web application flaws. The application knows who the user is, but a code path never asks what that user is allowed to do. Role based permission systems like the one in ERPNext only protect you if every endpoint that creates, reads or changes data calls the check.
The impact here is integrity first. In an ERP, a forged document can be a purchase order, a journal entry or a stock adjustment, and a low-privileged user creating one can bypass the separation of duties the roles were meant to enforce. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which ERPNext versions fix CVE-2026-109617?
The Frappe advisory lists 15.121.0 and 16.34.0 as patched. Anything older on those two lines is affected.
Is there a workaround?
The advisory says no workaround is available and that upgrading is required.
Sources
Last reviewed: 18 October 2026.
