SB2026092127 - Multiple vulnerabilities in ERPNext

Description

This security bulletin contains information about 2 vulnerabilities.

1) Cross-site scripting (CVE-ID: CVE-2026-109612)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]

The vulnerability allows a remote user to execute script in the session of a user who opens a report.

The vulnerability exists due to improper neutralization of input during web page generation in the report view when rendering stored record names in markup. A remote user can create a record with a crafted name to execute script in the session of a user who opens a report.

User interaction is required to open the report.

2) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated attacker with low privileges to read financial data beyond their permitted role in ERPNext.

The vulnerability exists due to missing authorization checks in certain ERPNext endpoints when processing requests to read data restricted by user roles. A remote authenticated attacker with low privileges can request data through these endpoints and obtain financial information without the required role permissions or victim interaction.

Remediation

Install update from vendor's website.

References

• https://github.com/frappe/erpnext/security/advisories/GHSA-f99r-gp2w-xghj
• https://github.com/frappe/erpnext/security/advisories/GHSA-q6qw-66cm-f9wj