Frappe ERPNext stored XSS via public booking page can let unauthenticated attackers take over accounts (CVE-2026-109633)

What happened

ERPNext's public-facing booking page accepts and stores content from unauthenticated visitors without neutralising the HTML. When a privileged user later views that submitted content, the browser renders the attacker's input as raw HTML rather than plain text. The CVE record describes this as stored cross-site scripting (CWE-79): script can execute in the privileged user's session, allowing the attacker to act as that user and take over the account.

The CVSS 4.0 score is 8.6, high severity. The weakness is reachable over the network and requires no privileges, but it does require a privileged user to view the malicious booking content. The fixed versions are ERPNext 15.119.1 and 16.32.0. No active exploitation is reported.

Who is affected

Organisations running ERPNext with a public booking page are affected. The vulnerable releases are all ERPNext versions before 15.119.1, and the 16.x line from 16.0.0-beta.1 through releases before 16.32.0. ERPNext is an open-source ERP platform whose booking page is public-facing by design, so the submission path can be reachable directly from the internet. Confirm your exact version and whether the booking page is enabled and externally reachable.

What to do now

1. Upgrade to ERPNext 15.119.1 if you are on the 15.x line, or 16.32.0 if you are on 16.x. These are the fixed versions listed for this advisory.
2. If you cannot patch immediately, consider restricting or temporarily disabling access to the public booking page to remove the unauthenticated submission path. No workaround has been published, so patching should be the priority.
3. After patching, review privileged accounts that may have viewed suspicious booking submissions for unexplained activity.

How to detect it

Review recent public booking submissions for raw HTML or script tags, particularly submissions that do not look like normal booking text. The advisory does not provide specific indicators of compromise. As a precaution, investigate unusual activity in privileged accounts that may have viewed suspicious bookings.

Beyond the patch

An unauthenticated, internet-reachable input path that stores HTML for later privileged users is exactly the kind of public web exposure that web application hardening should catch. Our Implementation & Assessment Services cover penetration testing and hardening reviews for public websites and shop platforms, and our Virtual CISO Services can help you keep exposed services visible and prioritised. Because ERPNext is open-source software you operate, tracking its release and patch cadence is also part of supply-chain risk management, which our Supply Chain Defense & Third-Party Risk service supports.