{"vulnerability": "CVE-2026-109615", "sightings": [{"uuid": "64493bb3-e67f-4074-92e4-547cf8f5acaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-109615", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117430425792872689", "content": "CVE-2026-109615 Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109615https://github.com/frappe/erpnext/security/advisories/GHSA-vg6r-89q7-wh34https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-missing-authorization-in-document-creation-endpoints#frappe #erpnext#CVE_2026_109615#bot", "creation_timestamp": "2026-10-12T23:01:38.587279Z"}]}