# CVE-2026-44442: Frappe ERPNext missing authorization in document modification endpoints

Source: https://junglewise.ai/threats/cve-2026-44442-frappe-erpnext-missing-authorization-in-document-modification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-13. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-44442 · Severity: critical · CVSS 9.9 · Published 2026-05-13

ERPNext, an open-source enterprise resource planning platform used to manage business processes like accounting and inventory, contains a security flaw in its authorization system. This vulnerability allows a logged-in user with limited permissions to modify sensitive business data and documents they should not be able to access. Exploitation could lead to unauthorized financial changes, data corruption, or a complete compromise of the business management system.

Technologies: [Frappe ERPNext](https://junglewise.ai/threats/technologies/erpnext). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2026-44442 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44442 being exploited in the wild.

**How severe is CVE-2026-44442?** Critical severity, with a CVSS score of 9.9, published 13 May 2026.

**Which products and versions are affected?** Frappe ERPNext < 16.9.1.

**Is there a fix for CVE-2026-44442?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-44442 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44442?** Check whether you run Frappe ERPNext at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in ERPNext prior to version 16.9.1. Certain API endpoints fail to perform adequate validation checks on user permissions before processing data modification requests. An attacker with low-privileged credentials can exploit this over the network to modify or delete documents across the system, potentially escalating their influence over the entire application environment (Scope: Changed). The vulnerability is addressed in version 16.9.1; no workarounds are available.

## Affected products

- Frappe ERPNext < 16.9.1

## Timeline

- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD

## References

- [https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9](https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9)

## Related threats

- [Frappe ERPNext missing authorization in buying utilities](https://junglewise.ai/threats/cve-2026-124316-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains)
- [Frappe ERPNext missing authorization in BOM methods](https://junglewise.ai/threats/cve-2026-124315-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains)
- [Frappe ERPNext missing authorization in CRM activities](https://junglewise.ai/threats/cve-2026-124314-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains)
- [Frappe ERPNext missing authorization in get_linked_payments](https://junglewise.ai/threats/cve-2026-124313-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains)
- [ERPNext authorization bypass in status modification endpoints](https://junglewise.ai/threats/cve-2026-108374-erpnext-is-a-free-and-open-source-enterprise-resource-planning)