Is CVE-2026-109628 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109628?

CVE-2026-109628 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109628

Description

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity.