Is CVE-2026-109641 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-109641?

CVE-2026-109641 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-109641

Description

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator has disabled the corresponding feature.