CVE-2026-109614

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-109614
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109614.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-109614
Aliases
  • GHSA-qcff-6669-j3gj
Published
2026-10-12T22:22:01Z
Modified
2026-10-16T02:30:39Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
Details

Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should not be able to view.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109614.json"
}
References

Affected packages

Git / github.com/frappe/erpnext

Affected ranges

Type
GIT
Repo
https://github.com/frappe/erpnext
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
80c2c9e0e000dad049366810919426449519ada5
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "16.34.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

4.*
4.0.0
4.0.0-beta1
v10.*
v10.0.0
v10.0.1
v10.0.2
v11.*
v11.0.0-beta
v12.*
v12.0.0
v12.0.1
v12.0.2
v12.0.3
v12.0.4
v12.0.5
v12.0.6
v12.0.7
v12.0.8
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.1.4
v12.1.5
v12.1.6
v14.*
v14.0.0-beta.2
v16.*
v16.0.0
v16.0.0-beta.1
v16.0.1
v16.1.0
v16.10.0
v16.10.1
v16.11.0
v16.12.0
v16.13.0
v16.13.1
v16.13.2
v16.13.3
v16.14.0
v16.15.0
v16.15.1
v16.16.0
v16.17.0
v16.18.0
v16.18.1
v16.18.2
v16.18.3
v16.19.0
v16.19.1
v16.2.0
v16.20.0
v16.20.1
v16.21.0
v16.21.1
v16.22.0
v16.23.0
v16.23.1
v16.24.0
v16.25.0
v16.26.0
v16.26.1
v16.26.2
v16.27.0
v16.28.0
v16.29.0
v16.3.0
v16.30.0
v16.31.0
v16.31.1
v16.32.0
v16.32.1
v16.32.2
v16.32.3
v16.33.0
v16.4.0
v16.4.1
v16.5.0
v16.6.0
v16.6.1
v16.7.0
v16.7.1
v16.7.2
v16.7.3
v16.8.0
v16.8.1
v16.8.2
v16.8.3
v16.9.0
v16.9.1
v3.*
v3.1.0
v3.1.1
v3.1.2
Other
v4-beta2
v4.*
v4.0.1
v4.10.0
v4.11.0
v4.11.1
v4.11.2
v4.12.0
v4.13.0
v4.13.1
v4.14.0
v4.15.0
v4.15.1
v4.15.2
v4.15.3
v4.15.4
v4.16.0
v4.17.0
v4.18.0
v4.18.1
v4.19.0
v4.20.0
v4.20.1
v4.20.2
v4.21.0
v4.21.1
v4.21.2
v4.21.3
v4.21.4
v4.22.0
v4.22.1
v4.22.2
v4.23.0
v4.24.0
v4.24.1
v4.24.2
v4.24.3
v4.24.4
v4.25.0
v4.25.1
v4.25.2
v4.25.3
v4.25.4
v4.25.5
v4.25.6
v4.25.7
v4.3.0
v4.4.0
v4.4.1
v4.4.2
v4.5.0
v4.5.1
v4.5.2
v4.6.0
v4.6.1
v4.6.2
v4.7.0
v4.7.1
v4.7.2
v4.8.0
v4.9.0
v4.9.1
v4.9.2
v4.9.3
v5.*
v5.0.0
v5.0.1
v5.0.10
v5.0.11
v5.0.12
v5.0.13
v5.0.14
v5.0.15
v5.0.16
v5.0.17
v5.0.18
v5.0.19
v5.0.2
v5.0.20
v5.0.21
v5.0.22
v5.0.23
v5.0.24
v5.0.25
v5.0.26
v5.0.27
v5.0.28
v5.0.29
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v5.1.0
v5.1.1
v5.1.2
v5.1.3
v5.1.4
v5.1.5
v5.1.6
v5.2.0
v5.2.1
v5.3.0
v5.3.1
v5.4.0
v5.4.1
v5.4.2
v5.5.0
v5.5.1
v5.6.0
v5.6.1
v5.6.2
v5.6.3
v5.6.4
v5.7.0
v5.7.1
v5.7.2
v5.7.3
v5.7.4
v5.7.5
v5.7.6
v5.7.7
v5.8.0
v5.8.1
v5.8.2
v6.*
v6.0.0
v6.0.1
v6.1.0
v6.1.1
v6.10.0
v6.10.1
v6.10.2
v6.11.0
v6.11.1
v6.11.2
v6.11.3
v6.12.0
v6.12.1
v6.12.10
v6.12.11
v6.12.2
v6.12.3
v6.12.4
v6.12.5
v6.12.6
v6.12.7
v6.12.8
v6.12.9
v6.13.0
v6.13.1
v6.14.0
v6.14.1
v6.15.0
v6.15.1
v6.16.0
v6.16.1
v6.16.2
v6.16.3
v6.16.4
v6.17.0
v6.18.0
v6.18.1
v6.18.2
v6.18.3
v6.18.4
v6.19.0
v6.2.0
v6.2.1
v6.20.0
v6.21.0
v6.21.1
v6.21.2
v6.21.3
v6.21.4
v6.21.5
v6.21.6
v6.22.0
v6.22.1
v6.23.0
v6.23.1
v6.23.2
v6.23.3
v6.23.4
v6.23.5
v6.23.6
v6.23.7
v6.24.0
v6.24.1
v6.24.2
v6.24.3
v6.24.4
v6.24.5
v6.25.0
v6.25.1
v6.25.2
v6.25.3
v6.25.4
v6.25.5
v6.26.0
v6.27.0
v6.27.1
v6.27.10
v6.27.11
v6.27.12
v6.27.13
v6.27.14
v6.27.15
v6.27.16
v6.27.17
v6.27.18
v6.27.19
v6.27.2
v6.27.20
v6.27.21
v6.27.22
v6.27.23
v6.27.24
v6.27.25
v6.27.26
v6.27.3
v6.27.4
v6.27.5
v6.27.6
v6.27.7
v6.27.8
v6.27.9
v6.3.0
v6.3.1
v6.3.2
v6.4.0
v6.4.1
v6.4.2
v6.4.3
v6.4.4
v6.4.5
v6.4.6
v6.4.7
v6.5.0
v6.5.1
v6.5.2
v6.5.3
v6.6.0
v6.6.1
v6.6.2
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.7.0
v6.7.1
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.7.7
v6.7.8
v6.8.0
v6.8.1
v6.8.2
v6.8.3
v6.8.4
v6.9.0
v6.9.1
v6.9.2
v7.*
v7.0.0
v7.0.1
v7.0.10
v7.0.11
v7.0.12
v7.0.13
v7.0.14
v7.0.15
v7.0.16
v7.0.17
v7.0.18
v7.0.19
v7.0.2
v7.0.20
v7.0.21
v7.0.22
v7.0.23
v7.0.24
v7.0.25
v7.0.26
v7.0.27
v7.0.28
v7.0.29
v7.0.3
v7.0.30
v7.0.31
v7.0.32
v7.0.33
v7.0.34
v7.0.35
v7.0.36
v7.0.37
v7.0.38
v7.0.39
v7.0.4
v7.0.40
v7.0.41
v7.0.42
v7.0.43
v7.0.44
v7.0.45
v7.0.46
v7.0.47
v7.0.48
v7.0.49
v7.0.5
v7.0.50
v7.0.51
v7.0.52
v7.0.53
v7.0.54
v7.0.55
v7.0.56
v7.0.57
v7.0.58
v7.0.59
v7.0.6
v7.0.60
v7.0.61
v7.0.62
v7.0.63
v7.0.7
v7.0.8
v7.0.9
v7.1.0
v7.1.1
v7.1.10
v7.1.11
v7.1.12
v7.1.13
v7.1.14
v7.1.15
v7.1.16
v7.1.17
v7.1.18
v7.1.19
v7.1.2
v7.1.20
v7.1.21
v7.1.22
v7.1.23
v7.1.24
v7.1.25
v7.1.26
v7.1.27
v7.1.28
v7.1.29
v7.1.3
v7.1.4
v7.1.5
v7.1.6
v7.1.7
v7.1.8
v7.1.9
v7.2.0
v7.2.1
v7.2.10
v7.2.11
v7.2.12
v7.2.13
v7.2.14
v7.2.15
v7.2.16
v7.2.17
v7.2.18
v7.2.19
v7.2.2
v7.2.20
v7.2.21
v7.2.22
v7.2.23
v7.2.24
v7.2.25
v7.2.26
v7.2.27
v7.2.28
v7.2.29
v7.2.3
v7.2.30
v7.2.31
v7.2.32
v7.2.4
v7.2.5
v7.2.6
v7.2.7
v7.2.8
v7.2.9
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.12
v8.0.13
v8.0.14
v8.0.15
v8.0.16
v8.0.17
v8.0.18
v8.0.19
v8.0.2
v8.0.20
v8.0.21
v8.0.22
v8.0.23
v8.0.24
v8.0.25
v8.0.26
v8.0.27
v8.0.28
v8.0.29
v8.0.3
v8.0.30
v8.0.31
v8.0.32
v8.0.33
v8.0.34
v8.0.35
v8.0.36
v8.0.37
v8.0.38
v8.0.39
v8.0.4
v8.0.40
v8.0.41
v8.0.42
v8.0.43
v8.0.44
v8.0.45
v8.0.46
v8.0.47
v8.0.48
v8.0.49
v8.0.5
v8.0.50
v8.0.51
v8.0.6
v8.0.7
v8.0.8
v8.0.9
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.1.5
v8.1.6
v8.1.7
v8.10.0
v8.10.1
v8.10.2
v8.11.0
v8.11.1
v8.11.2
v8.11.3
v8.11.4
v8.11.5
v8.11.6
v8.2.0
v8.2.1
v8.2.2
v8.2.3
v8.2.4
v8.2.5
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.3.4
v8.3.5
v8.3.6
v8.4.0
v8.4.1
v8.4.2
v8.4.3
v8.5.0
v8.5.1
v8.5.2
v8.5.3
v8.5.4
v8.5.5
v8.6.0
v8.6.1
v8.6.2
v8.6.3
v8.6.4
v8.6.5
v8.6.6
v8.7.0
v8.7.1
v8.7.2
v8.7.3
v8.8.0
v8.8.1
v8.8.2
v8.8.3
v8.8.4
v8.8.5
v8.8.6
v8.9.0
v8.9.1
v8.9.2
v9.*
v9.0.0
v9.0.1
v9.0.2
v9.0.3
v9.0.4
v9.0.5
v9.0.6
v9.0.7
v9.0.8
v9.0.9
v9.1.0
v9.1.1
v9.1.2
v9.1.3
v9.1.4
v9.1.5
v9.1.6
v9.1.7
v9.1.8
v9.2.0
v9.2.1
v9.2.10
v9.2.11
v9.2.12
v9.2.13
v9.2.14
v9.2.15
v9.2.16
v9.2.17
v9.2.18
v9.2.19
v9.2.2
v9.2.20
v9.2.21
v9.2.22
v9.2.23
v9.2.24
v9.2.3
v9.2.4
v9.2.5
v9.2.6
v9.2.7
v9.2.8
v9.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109614.json"