CVE-2026-109633
Frappe ERPNext public booking page stored XSS enables account takeover (CVE-2026-109633)
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 has a stored XSS flaw in its public booking page. An unauthenticated attacker can submit script that runs when a privileged user views it, enabling account takeover. Update to 15.119.1 or 16.32.0.
What happened
ERPNext's public-facing booking page accepts content from unauthenticated visitors and stores it without neutralising HTML. When a privileged user later opens the affected page, the submitted content is rendered as raw HTML, so JavaScript supplied by the attacker runs in that user's session. The attacker can act as that user, read and alter business records, and take over the account. The CVSS 4.0 base score is 8.6, with high confidentiality and integrity impact and no availability impact.
The only condition for success is passive interaction by a privileged user, such as opening or reviewing the booking page; the attacker needs no prior credentials and can reach the page over the network. The CVE record does not report active exploitation, and the flaw is not in CISA's KEV catalogue.
Who is affected
Frappe ERPNext before 15.119.1 and 16.0.0-beta.1 to before 16.32.0 are affected. Any deployment running those versions with the public booking page enabled should be checked. The risk concentrates where unauthenticated visitors can reach that page and a privileged user reviews submissions.
What to do now
- Upgrade to a fixed release: ERPNext 15.119.1 for the 15.x line, or ERPNext 16.32.0 for the 16.x line.
- If the update cannot be applied immediately, restrict access to the public booking page, or disable it, until the fixed release is in place.
- Treat booking submissions created before the patch as untrusted. Have a privileged user review them for unexpected HTML or script content before normal use resumes.
No separate workaround is listed for this flaw.
How to detect it
Review existing booking submissions for raw HTML or script fragments, especially records created before the patch. Monitor privileged accounts that open booking pages for unexpected changes to passwords, roles, or business records. The stored payload is submitted through public bookings and rendered in a privileged user's session, so those booking records are the main exposure point.
Beyond the patch
This is a public input path that leads directly to a privileged session, so the underlying risk is an exposed trust boundary rather than just one missed patch. Once the update is applied, have the public-facing ERPNext instance checked through a penetration test and hardening review, and make recurrence of exposed services less likely through Virtual CISO Services (vCISO). If a supplier operates your ERPNext, track its patch response with Supply Chain Defense & Third-Party Risk.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| erpnext | – < 15.119.1 16.0.0-beta.1 – < 16.32.0 | 15.119.1 16.32.0 |