SB2026081374 - Multiple vulnerabilities in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081374

SB2026081374 - Multiple vulnerabilities in ERPNext

Published: August 13, 2026

Security Bulletin ID SB2026081374
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-72911)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in a template engine in certain fields rendered as server-side templates when processing user-supplied template expressions. A remote user can inject crafted template expressions to execute arbitrary code.

The injected expressions are evaluated in an unrestricted execution context, and the issue can also expose data across the application.


2) SQL injection (CVE-ID: CVE-2026-65822)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to SQL injection in some endpoints when handling specially crafted requests. A remote user can send specially crafted requests to disclose sensitive information.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute script in the browser of another user.

The vulnerability exists due to cross-site scripting in the record name field when rendering a record name without escaping. A remote user can edit a record name with crafted script content to execute script in the browser of another user.

User interaction is required when a colleague opens the affected page.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive financial data.

The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can access data beyond their permitted role to disclose sensitive financial data.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive financial data.

The vulnerability exists due to improper access control in certain endpoints when handling requests. A remote user can access data beyond their permitted role to disclose sensitive financial data.


Remediation

Install update from vendor's website.

References