SB2026092048 - Multiple vulnerabilities in ERPNext
Published: September 20, 2026 Updated: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-94113)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can access data beyond their permitted role to disclose sensitive information.
2) Missing Authorization (CVE-ID: CVE-2026-109611)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify data beyond their permitted role.
The vulnerability exists due to missing authorization in certain ERPNext endpoints when handling requests. A remote user can send requests to modify data beyond their permitted role.
3) Missing Authorization (CVE-ID: CVE-2026-109613)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify data beyond their permitted role.
The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can send requests to the affected endpoints to modify data beyond their permitted role.
4) Missing Authorization (CVE-ID: CVE-2026-109614)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose financial data beyond their permitted role.
The vulnerability exists due to missing authorization in certain ERPNext endpoints when handling requests. A remote user can access data beyond their permitted role to disclose financial data beyond their permitted role.
5) Missing Authorization (CVE-ID: CVE-2026-109615)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create unauthorized documents.
The vulnerability exists due to missing authorization in certain ERPNext endpoints when processing requests to create documents. A remote user can create documents against records beyond their permitted role to create unauthorized documents.
6) Missing Authorization (CVE-ID: CVE-2026-109617)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to create documents against records beyond their permitted role.
The vulnerability exists due to missing authorization in certain endpoints when handling document-creation requests. A remote user can send document-creation requests to create documents against records beyond their permitted role.
7) Missing Authorization (CVE-ID: CVE-2026-109622)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify documents beyond their permitted role.
The vulnerability exists due to missing authorization in certain ERPNext endpoints when handling requests to modify documents. A remote user can send a request to modify data beyond their permitted role.
8) SQL injection (CVE-ID: CVE-2026-109608)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to read sensitive information belonging to other users and escalate to a privileged account.
The vulnerability exists due to improper neutralization of special elements used in an SQL command in ERPNext endpoints when handling specially crafted requests. A remote user can send a specially crafted request to read sensitive information belonging to other users and escalate to a privileged account.
Users with no assigned roles can exploit the vulnerability.
9) Missing Authorization (CVE-ID: CVE-2026-108374)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker with low privileges to modify ERPNext status data beyond the permissions of their assigned role.
The vulnerability exists due to missing authorization checks in certain ERPNext endpoints when processing requests to change data. A remote authenticated attacker with low privileges can submit requests to these endpoints and make unauthorized status changes without victim interaction.
10) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged remote attacker to read ERPNext data beyond the access permitted by their assigned role.
The vulnerability exists due to missing authorization checks in certain ERPNext endpoints when handling requests to read data subject to role-based access restrictions. A low-privileged remote attacker can send requests to these endpoints and obtain data outside their role's permissions without requiring interaction from another user.
11) SQL injection (CVE-ID: N/A)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a high-privileged remote attacker to extract sensitive information from ERPNext through SQL injection.
The vulnerability exists due to missing validation of request input in affected ERPNext endpoints when specially crafted requests are processed. A high-privileged remote attacker can submit these requests over the network to manipulate SQL queries and retrieve sensitive information without requiring interaction from another user.
12) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker to modify site-wide failed bulk transaction logs in ERPNext and remove entries from the normal recovery path.
The vulnerability exists due to missing authorization checks in the Utilities module endpoint when retrying failed bulk transactions for a chosen date. An authenticated attacker can submit a crafted request to queue those transactions and mark their logs as retried, even with no assigned roles and without victim interaction.
Remediation
Install update from vendor's website.
References
- https://github.com/frappe/erpnext/security/advisories/GHSA-9vph-hqmm-g7hq
- https://github.com/frappe/erpnext/security/advisories/GHSA-p4jx-mqwq-66cj
- https://github.com/frappe/erpnext/security/advisories/GHSA-wp9w-rxmg-6pfj
- https://github.com/frappe/erpnext/security/advisories/GHSA-qcff-6669-j3gj
- https://github.com/frappe/erpnext/security/advisories/GHSA-vg6r-89q7-wh34
- https://github.com/frappe/erpnext/security/advisories/GHSA-vr45-2p9x-3vjc
- https://github.com/frappe/erpnext/security/advisories/GHSA-2r76-j6jj-jj56
- https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v
- https://github.com/frappe/erpnext/security/advisories/GHSA-5wpj-6rvp-9ff7
- https://github.com/frappe/erpnext/security/advisories/GHSA-pr7v-95jp-gwwv
- https://github.com/frappe/erpnext/security/advisories/GHSA-h787-3x6w-8x4m
- https://github.com/frappe/erpnext/security/advisories/GHSA-ggr3-x356-w97h