CVE-2026-109667

{
  "etk_id": "ETK-2026-1427",
  "cve_id": "CVE-2026-109667",
  "display_id": "CVE-2026-109667",
  "ghsa_id": "GHSA-f3v4-m95v-25ch",
  "euvd_id": "EUVD-2026-98058",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Privilege escalation in Frappe ERPNext record creation",
  "summary": "Frappe ERPNext releases before 15.111.0 and 16.x releases before 16.22.0 are affected by an authorization flaw in record creation. An authenticated user, even without an operational role, may create privileged accounts and obtain full site control.",
  "mitigation": "Upgrade ERPNext to 15.111.0 or later, or to 16.22.0 or later. Restrict access for untrusted authenticated users until the upgrade is complete.",
  "vendor": "frappe",
  "product": "erpnext",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 15.111.0"
      ],
      "ecosystem": "frappe",
      "fixed_versions": [
        "15.111.0"
      ],
      "package_name": "erpnext",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 16.22.0"
      ],
      "ecosystem": "frappe",
      "fixed_versions": [
        "16.22.0"
      ],
      "package_name": "erpnext",
      "purl": null
    }
  ],
  "cwes": [
    269
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1486,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 50.120655283333335,
  "t0_at": "2026-10-12T22:22:33.562000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T23:40:54.751999+00:00",
      "days": 0.05441192128472222,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T22:22:33.562000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-12T22:22:33.562000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T22:22:33.562000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109667"
    }
  }
}