SB2026080513 - Multiple vulnerabilities in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080513

SB2026080513 - Multiple vulnerabilities in ERPNext

Published: August 5, 2026 Updated: August 14, 2026

Security Bulletin ID SB2026080513
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 33% Low 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Improper access control (CVE-ID: CVE-2026-72909)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions on certain endpoints. A remote user can bypass implemented security restrictions and read financial data.


2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can send crafted requests to disclose sensitive information.

The issue allows access to data beyond the user's permitted role.


3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to induce the server to send requests to unintended destinations and disclose limited information.

The vulnerability exists due to server-side request forgery in a configuration field for outbound requests when processing user-supplied destination values. A remote user can supply an arbitrary destination to cause the server to issue requests to hosts of their choosing and disclose limited information.

The destination may include addresses reachable only from inside the deployment's network.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify production records.

The vulnerability exists due to improper authorization in certain endpoints when handling requests. A remote user can send crafted requests to modify production records.

The issue allows users to modify data beyond their permitted role.


5) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in portal pages when rendering stored content from public portal form submissions. A remote attacker can submit crafted markup that is later viewed by staff to execute arbitrary script in a victim's browser.

User interaction is required because staff must review the submitted record.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify arbitrary records.

The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can send crafted requests to modify arbitrary records.

The issue allows modification of a field on record types outside the permissions of the user's role.


Remediation

Install update from vendor's website.

References