Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| frappe | erpnext | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 12 Oct 2026 22:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operational roles, that accepts an arbitrary outbound request destination without validation. Authenticated attackers can set the field to hosts of their choosing, making the server issue requests to addresses reachable only from inside the deployment's network. | |
| Title | Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field | |
| First Time appeared |
Frappe
Frappe erpnext |
|
| Weaknesses | CWE-918 | |
| CPEs | cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Frappe
Frappe erpnext |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-12T22:22:23.264Z
Reserved: 2026-10-12T21:06:47.173Z
Link: CVE-2026-109651
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-918
Server-Side Request Forgery (SSRF)