Is CVE-2026-109621 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109621?

CVE-2026-109621 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109621

Description

Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and read party records beyond their permitted role.