ERPNext privilege escalation lets any authenticated user create privileged accounts (CVE-2026-109667)

What happened

An attacker with any authenticated ERPNext account, including one holding no operational role, can exploit a record-creation endpoint. The endpoint takes the record type from the request and inserts the record with permission checks disabled. By supplying a privileged record type, an attacker can create privileged accounts and take full control of the site.

The flaw is reachable over the network and requires only low-privilege authentication, with no user interaction. The CVSS 4.0 score is 8.7 (high), with high impact on confidentiality, integrity and availability of the ERPNext instance. It is not listed in CISA's KEV catalogue, and the CVE record does not state public exploitation.

Who is affected

ERPNext before 15.111.0 is affected. The 16.x branch is affected from 16.0.0-beta.1 through versions before 16.22.0. If your organisation runs ERPNext, assume any authenticated user can attempt this until the upgrade is applied.

What to do now

1. Upgrade to the matching fixed release: ERPNext 15.111.0 for 15.x deployments, or ERPNext 16.22.0 for 16.x deployments.
2. Until the upgrade is complete, restrict ERPNext access where possible and remove or suspend accounts that do not need it.
3. Review existing ERPNext user accounts and role assignments for unexpected privileged accounts, and disable any that cannot be attributed to legitimate administration.

How to detect it

Review ERPNext user and role change logs for accounts that receive administrative or otherwise privileged roles without a corresponding authorised change. Unexpected privileged-account creation is the main activity this flaw enables.

Beyond the patch

Once the patch is applied, this class of flaw still matters: an authenticated user becoming a full site administrator is primarily an identity and monitoring problem. Our Managed Detection & Response (MDR) watches for the privilege escalation and credential abuse that follow, and if ERPNext runs in a partner or supplier environment, Supply Chain Defense & Third-Party Risk helps you track whether the vendors you depend on are applying fixes like this one.