{"id":"CVE-2026-109667","published":"2026-10-12T23:17:34.210","lastModified":"2026-10-14T13:17:27.710","description":"Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-x635-wr4c-7345","tags":[]},{"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-15.111.0-privilege-escalation-via-unauthorized-record-creation","tags":[]}],"exploitRefs":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-x635-wr4c-7345","tags":[]}],"hasPoc":true,"ai":{"summary":"An authenticated user can create privileged records without proper permission checks, allowing them to escalate privileges and gain full control of the ERPNext site. This vulnerability affects versions before 15.111.0 and 16.x before 16.22.0.","exploitability":"Easy to exploit with minimal preconditions - any authenticated user can create privileged records by supplying a privileged record type in their request, requiring no special roles or permissions.","blast_radius":"The vulnerability could allow attackers to create admin accounts and fully compromise the ERPNext site, potentially affecting all business data and operations across the organization.","remediation":"Upgrade to ERPNext version 15.111.0 or 16.22.0 to remediate this privilege escalation vulnerability.","detection":"Monitor for unusual record creation requests in application logs that attempt to create privileged record types such as user accounts, system settings, or administrative records without proper authorization checks.","tags":["privilege-escalation","auth-bypass","web"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:35.868Z"}}