High priorityDisclosed

Advisory · CVE-2026-109667

ERPNext record creation flaw lets any user create privileged accounts

ERPNext before 15.111.0 and 16.x before 16.22.0 has a record-creation endpoint that inserts records with permission checks disabled, letting any authenticated user create privileged accounts and take full control. CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
Frappe
Product
ERPNext
Identifier / CWE
CVE-2026-109667
CWE-269
Action timing
Immediate
ELI5

Explain it like I’m five

One ERPNext endpoint skips the permission check when it creates records, so any user can ask it to create an administrator.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Any account

    An authenticated attacker, even with no operational role, reaches the record-creation endpoint.

  2. 02Privileged record type

    The attacker supplies a privileged record type, and the endpoint inserts it with permission checks disabled.

  3. 03Full control

    The attacker uses the new privileged account to take full control of the site.

What happened

The Frappe project disclosed CVE-2026-109667 for ERPNext before 15.111.0 and 16.x before 16.22.0. A record-creation endpoint takes the record type from the request and inserts the record with permission checks disabled (CWE-269). Any authenticated user can supply a privileged record type to create privileged accounts and take full control of the site.

Per the vendor’s affected data, upgrade to 15.111.0 or 16.22.0 or later for the respective lines.

What to do

  1. Inventory every ERPNext deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ERPNext while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for newly created privileged accounts and record-creation calls by users with no operational role.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

This is the simplest kind of critical: a missing check on the door to admin creation. Upgrade and reconcile every privileged account.