{"vulnerability": "CVE-2026-109656", "sightings": [{"uuid": "5ac259bd-24e3-42a4-a0e8-8512a2926971", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-109656", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117430526387533124", "content": "CVE-2026-109656 Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read item master data beyond their permitted role.\nhttps://www.cve.org/CVERecord?id=CVE-2026-109656https://github.com/frappe/erpnext/security/advisories/GHSA-4j82-w8f7-hqqphttps://www.vulncheck.com/advisories/frappe-erpnext-before-15.118.2-unauthorized-item-master-data-access#frappe #erpnext#CVE_2026_109656#bot", "creation_timestamp": "2026-10-12T23:27:12.148252Z"}]}