CVE-2026-109658

Publié : 12 octobre 2026

Modifié : 12 octobre 2026

Score CVSS

6.5

MEDIUM

Description détaillée

Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Références et Patchs

https://github.com/frappe/erpnext/security/advisories/GHSA-gq9h-847p-h692 https://www.vulncheck.com/advisories/frappe-erpnext-before-15.115.0-missing-authorization-on-endpoints

Dernières Vulnérabilités

CVE-2026-96119

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application.

VOIR DÉTAILS

CVE-2026-93886

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input.

VOIR DÉTAILS

CVE-2026-81858

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server.

VOIR DÉTAILS