# Frappe ERPNext vulnerabilities Source: https://junglewise.ai/threats/technologies/erpnext Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/erpnext.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 100 vulnerabilities in Frappe ERPNext: 4 in the last 7 days and 76 in the last 90 days, 5 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124316, was published on 7 November 2026. 74 vulnerabilities in the last four weeks, up 3600% on the four before (2). ## Counts - Last 7 days: 4 - Last 30 days: 6 - Last 90 days: 76 - All time: 100 (5 critical, 0 exploited in the wild) ## About Frappe ERPNext ERPNext is an open-source enterprise resource planning system for managing business operations and workflows. ## Latest Frappe ERPNext vulnerabilities - [CVE-2026-124316: Frappe ERPNext missing authorization in buying utilities](https://junglewise.ai/threats/cve-2026-124316-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-124315: Frappe ERPNext missing authorization in BOM methods](https://junglewise.ai/threats/cve-2026-124315-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-124314: Frappe ERPNext missing authorization in CRM activities](https://junglewise.ai/threats/cve-2026-124314-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 6.5, published 7 Nov 2026) - [CVE-2026-124313: Frappe ERPNext missing authorization in get_linked_payments](https://junglewise.ai/threats/cve-2026-124313-frappe-erpnext-before-15-121-4-and-16-x-before-16-36-0-contains) (medium, CVSS 4.3, published 7 Nov 2026) - [CVE-2026-108374: ERPNext authorization bypass in status modification endpoints](https://junglewise.ai/threats/cve-2026-108374-erpnext-is-a-free-and-open-source-enterprise-resource-planning) (high, CVSS 7.7, published 16 Oct 2026) - [CVE-2026-108373: ERPNext authorization bypass in Sales Person-wise Transaction Summary](https://junglewise.ai/threats/cve-2026-108373-erpnext-is-a-free-and-open-source-enterprise-resource-planning) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-109674: Frappe ERPNext SQL injection in endpoints](https://junglewise.ai/threats/cve-2026-109674-frappe-erpnext-before-15-98-0-and-16-x-before-16-6-0-contains-an) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109673: Frappe ERPNext stored cross-site scripting in dashboards and portals](https://junglewise.ai/threats/cve-2026-109673-frappe-erpnext-before-15-103-0-and-16-x-before-16-12-0-contains) (high, CVSS 7.3, published 12 Oct 2026) - [CVE-2026-109672: Frappe ERPNext missing authorization in financial data endpoints](https://junglewise.ai/threats/cve-2026-109672-frappe-erpnext-before-15-118-0-and-16-x-before-16-27-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109671: Frappe ERPNext stored cross-site scripting in profile field](https://junglewise.ai/threats/cve-2026-109671-frappe-erpnext-before-15-113-0-and-16-x-before-16-24-0-contains) (high, CVSS 7.3, published 12 Oct 2026) - [CVE-2026-109670: Frappe ERPNext stored cross-site scripting in item record names](https://junglewise.ai/threats/cve-2026-109670-frappe-erpnext-before-15-110-0-and-16-x-before-16-21-0-contains) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109669: Frappe ERPNext missing authorization in record status endpoints](https://junglewise.ai/threats/cve-2026-109669-frappe-erpnext-before-15-110-0-and-16-x-before-16-21-0-contains) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109668: Frappe ERPNext missing authorization in party record endpoints](https://junglewise.ai/threats/cve-2026-109668-frappe-erpnext-before-15-110-0-and-16-x-before-16-21-0-contains) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109667: Frappe ERPNext privilege escalation in record-creation endpoint](https://junglewise.ai/threats/cve-2026-109667-frappe-erpnext-before-15-111-0-and-16-x-before-16-22-0-contains) (high, CVSS 8.8, published 12 Oct 2026) - [CVE-2026-109666: Frappe ERPNext missing authorization in inventory endpoints](https://junglewise.ai/threats/cve-2026-109666-frappe-erpnext-before-15-110-0-and-16-x-before-16-21-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109665: Frappe ERPNext missing authorization in deactivation endpoints](https://junglewise.ai/threats/cve-2026-109665-frappe-erpnext-before-15-108-0-and-16-x-before-16-18-0-contains) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109664: Frappe ERPNext missing authorization in record modification](https://junglewise.ai/threats/cve-2026-109664-frappe-erpnext-before-15-112-0-contains-a-missing-authorization) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-109663: Frappe ERPNext SQL injection in endpoint validation](https://junglewise.ai/threats/cve-2026-109663-frappe-erpnext-before-15-113-0-and-16-x-before-16-22-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109662: Frappe ERPNext stored XSS in public portal form](https://junglewise.ai/threats/cve-2026-109662-frappe-erpnext-before-15-112-0-and-16-x-before-16-23-0-contains) (medium, CVSS 6.1, published 12 Oct 2026) - [CVE-2026-109661: Frappe ERPNext missing authorization in financial endpoints](https://junglewise.ai/threats/cve-2026-109661-frappe-erpnext-before-15-116-0-and-16-x-before-16-27-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109660: Frappe ERPNext authorization bypass in production record endpoints](https://junglewise.ai/threats/cve-2026-109660-frappe-erpnext-before-15-112-0-and-16-x-before-16-23-0-has) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109659: Frappe ERPNext missing authorization in financial data endpoints](https://junglewise.ai/threats/cve-2026-109659-frappe-erpnext-before-15-113-0-and-16-x-before-16-24-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109658: Frappe ERPNext missing authorization in endpoints](https://junglewise.ai/threats/cve-2026-109658-frappe-erpnext-before-15-115-0-and-16-x-before-16-26-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) - [CVE-2026-109657: Frappe ERPNext stored cross-site scripting in record name](https://junglewise.ai/threats/cve-2026-109657-frappe-erpnext-16-x-before-16-27-0-contains-a-stored-cross-site) (medium, CVSS 5.4, published 12 Oct 2026) - [CVE-2026-109656: Frappe ERPNext missing authorization on item master endpoints](https://junglewise.ai/threats/cve-2026-109656-frappe-erpnext-before-15-118-2-and-16-x-before-16-30-0-contains) (medium, CVSS 6.5, published 12 Oct 2026) ## Most severe Frappe ERPNext vulnerabilities - [CVE-2026-44442: Frappe ERPNext missing authorization in document modification endpoints](https://junglewise.ai/threats/cve-2026-44442-frappe-erpnext-missing-authorization-in-document-modification) (critical, CVSS 9.9, published 13 May 2026) - [CVE-2026-38431: Frappe ERPNext SSTI in Email Template Engine](https://junglewise.ai/threats/cve-2026-38431-frappe-erpnext-ssti-in-email-template-engine) (critical, CVSS 9.8, published 5 May 2026) - [CVE-2025-67289: Frappe Framework and ERPNext Arbitrary File Upload in Attachments](https://junglewise.ai/threats/cve-2025-67289-frappe-framework-and-erpnext-arbitrary-file-upload-in-attachments) (critical, CVSS 9.6, published 22 Dec 2025) - [CVE-2026-31017: Frappe ERPNext and Frappe Framework SSRF in Print Format PDF generation](https://junglewise.ai/threats/cve-2026-31017-frappe-erpnext-and-frappe-framework-ssrf-in-print-format-pdf) (critical, CVSS 9.1, published 8 Apr 2026) - [CVE-2025-65267: In ERPNext v15.83.2 and Frappe Framework v15.86.0, improper validation of uploaded SVG avatar images allows attackers…](https://junglewise.ai/threats/cve-2025-65267-in-erpnext-v15-83-2-and-frappe-framework-v15-86-0-improper) (critical, CVSS 9, published 3 Dec 2025) - [CVE-2023-54345: Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated…](https://junglewise.ai/threats/cve-2023-54345-frappe-framework-erpnext-13-4-0-contains-a-sandbox-escape) (high, CVSS 8.8, published 5 May 2026) - [CVE-2025-66437: An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext…](https://junglewise.ai/threats/cve-2025-66437-an-ssti-server-side-template-injection-vulnerability-exists-in) (high, CVSS 8.8, published 15 Dec 2025) - [CVE-2025-66434: An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext…](https://junglewise.ai/threats/cve-2025-66434-an-ssti-server-side-template-injection-vulnerability-exists-in) (high, CVSS 8.8, published 15 Dec 2025) - [CVE-2025-66438: A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format…](https://junglewise.ai/threats/cve-2025-66438-a-server-side-template-injection-ssti-vulnerability-exists-in-the) (high, CVSS 8.8, published 15 Dec 2025) - [CVE-2025-66440: An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at…](https://junglewise.ai/threats/cve-2025-66440-an-issue-was-discovered-in-frappe-erpnext-through-15-89-0) (high, CVSS 8.8, published 15 Dec 2025) ## Vulnerabilities per week 74 vulnerabilities in the last four weeks, up 3600% on the four before (2). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 70 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 4 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Frappe technologies - [Frappe Framework](https://junglewise.ai/threats/technologies/frappe): 49 vulnerabilities - [Frappe Learning](https://junglewise.ai/threats/technologies/learning): 10 vulnerabilities - [Frappe HR](https://junglewise.ai/threats/technologies/hr): 9 vulnerabilities - [Frappe Crm](https://junglewise.ai/threats/technologies/frappe-crm): 6 vulnerabilities - [Frappe Learning Management System](https://junglewise.ai/threats/technologies/learning-management-system): 5 vulnerabilities - [Frappe Builder](https://junglewise.ai/threats/technologies/frappe-builder): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Frappe ERPNext vulnerabilities", https://junglewise.ai/threats/technologies/erpnext, 12 November 2026.