CVE-2026-109667

Summary

An authenticated user can create privileged records without proper permission checks, allowing them to escalate privileges and gain full control of the ERPNext site. This vulnerability affects versions before 15.111.0 and 16.x before 16.22.0.

Exploitability

Easy to exploit with minimal preconditions - any authenticated user can create privileged records by supplying a privileged record type in their request, requiring no special roles or permissions.

Blast radius

The vulnerability could allow attackers to create admin accounts and fully compromise the ERPNext site, potentially affecting all business data and operations across the organization.

Detection

Monitor for unusual record creation requests in application logs that attempt to create privileged record types such as user accounts, system settings, or administrative records without proper authorization checks.

Prioritized remediation

Upgrade to ERPNext version 15.111.0 or 16.22.0 to remediate this privilege escalation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.