SB20261109175 - Multiple vulnerabilities in ERPNext

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authorization (CVE-ID: CVE-2026-109623)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated attacker with low privileges to modify ERPNext documents beyond the permissions granted to their role.

The vulnerability exists due to missing authorization checks in certain ERPNext endpoints when processing requests to modify document data. A remote authenticated attacker with low privileges can submit modification requests to these endpoints and change data without the required role permissions or any victim interaction.

2) SQL injection (CVE-ID: CVE-2026-109626)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated remote attacker with low privileges to extract sensitive information from ERPNext through SQL injection without victim interaction.

The vulnerability exists due to missing validation of request input in affected ERPNext endpoints when specially crafted requests are processed. An authenticated remote attacker with low privileges can submit these requests to inject SQL commands and retrieve sensitive information.

Remediation

Install update from vendor's website.

References

• https://github.com/frappe/erpnext/security/advisories/GHSA-49wp-r82c-j825
• https://github.com/frappe/erpnext/security/advisories/GHSA-mp29-fjc5-h86p