SB2026092049 - Multiple vulnerabilities in ERPNext
Published: September 20, 2026 Updated: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-109616)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify data beyond their permitted role.
The vulnerability exists due to missing authorization in certain endpoints when handling requests. A remote user can send requests to modify data beyond their permitted role.
2) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privilege authenticated remote attacker to read sensitive tax and payment information belonging to other companies or outside their authorized scope.
The vulnerability exists due to missing authorization checks in ERPNext financial reporting endpoints when generating reports from user requests. A low-privilege authenticated remote attacker can submit a crafted reporting request to obtain unauthorized reports containing identifiers and financial totals without victim interaction.
3) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote authenticated attacker with low privileges to send unauthorized email carrying the organisation's sending identity.
The vulnerability exists due to missing authorization checks in an ERPNext email endpoint when processing caller-supplied recipients and message content. A remote authenticated attacker with low privileges can submit chosen recipients and content to the endpoint, causing messages to be sent through the site's configured outgoing email account.
Remediation
Install update from vendor's website.