Frappe ERPNext privilege escalation lets authenticated users create privileged accounts (CVE-2026-109667)

What happened

Frappe ERPNext contains a privilege escalation flaw in a record-creation endpoint. The endpoint takes the record type from the request and inserts the record with permission checks disabled. Because the record type is not restricted, any authenticated user — including one holding no operational role — can supply a privileged record type. That allows a low-privileged account to create additional privileged accounts and ultimately take full control of the ERPNext site. The vulnerability is reachable over the network, requires no user interaction, and has a CVSS 4.0 score of 8.7 (high). The CVE record does not state that exploitation in the wild has been observed.

Who is affected

Affected versions are erpnext before 15.111.0 and erpnext 16.0.0-beta.1 through versions before 16.22.0. If you run ERPNext, check whether your release falls into either range. The vulnerability is in the core product and is reachable by any authenticated user, so exposure is not limited to administrators or users with an operational role.

What to do now

1. Patch immediately. Frappe has released erpnext 15.111.0 for the 15.x line and erpnext 16.22.0 for the 16.x line. Upgrade to the matching fixed release.
2. No workaround is listed in the available advisory data, so patching is the primary remediation.
3. Until patching is complete, reduce the number of accounts that can authenticate to the ERPNext instance, because any authenticated account can reach the vulnerable endpoint.
4. Review existing privileged accounts and remove or disable any that cannot be tied to a legitimate business change.

How to detect it

Review ERPNext user lists for new accounts with high privileges, especially accounts created by users who do not normally administer the system. The vulnerability creates privileged accounts, so an unexplained privileged account is the most direct sign of exploitation. No vendor-published indicators of compromise are provided in the CVE record.

Beyond the patch

This is a patch-first incident, but the underlying lesson is that a low-privileged account moving to full control is most dangerous when nobody notices the step in between. Managed Detection & Response is built for exactly that: EDR and SIEM telemetry can alert when an unprivileged user suddenly creates privileged accounts. For teams running ERPNext alongside other business applications, Supply Chain Defense & Third-Party Risk helps track which versions you run and how quickly vendors ship fixes, so a bulletin like this reaches the right owner while patching is still straightforward.