SB20261109178 - Multiple vulnerabilities in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109178

SB20261109178 - Multiple vulnerabilities in ERPNext

Published: November 9, 2026 Updated: November 9, 2026

Security Bulletin ID SB20261109178
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read asset depreciation data belonging to companies they are not permitted to access.

The vulnerability exists due to missing asset read authorization checks in ERPNext Assets module endpoints when resolving depreciation schedules from caller-supplied assets. An authenticated attacker can submit a request naming another company's asset to retrieve its purchase value, depreciated value, and depreciation entries without victim interaction.


2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user with Accounts access to read Payment Entry metadata excluded by their user permissions within the same company.

The vulnerability exists due to missing read permission checks on related Payment Entries returned by an ERPNext Accounts endpoint when processing a readable bank record. An authenticated user with Accounts access can request that record through the endpoint and obtain restricted metadata without victim interaction.


3) Files or Directories Accessible to External Parties (CVE-ID: N/A)

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read imported supplier e-invoices containing sensitive financial information.

The vulnerability exists due to ERPNext's Regional module storing supplier electronic invoice files as publicly accessible files when importing invoices for Italy. An unauthenticated remote attacker can derive an invoice's public URL from the supplier's VAT number and invoice sequence and retrieve its contents without victim interaction.


4) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated desk user with an ordinary job role to read customer documents outside their permitted scope in ERPNext.

The vulnerability exists due to missing record-level authorization checks in print and portal views when requests specify customer documents excluded by User Permissions. An authenticated desk user with an ordinary job role can send a crafted request naming restricted records and receive their contents without victim interaction.


5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user to read Sales Order line items in ERPNext beyond their permitted scope, including with no assigned roles.

The vulnerability exists due to missing record-level authorization checks in a Selling module endpoint when requests specify Sales Orders the caller cannot read. An authenticated user can submit a crafted request naming those records and receive their line items without victim interaction.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read project costing and margin information outside their permitted scope in ERPNext.

The vulnerability exists due to missing record-level authorization checks in the customer portal's project list endpoint when returning project fields for requested records. An authenticated attacker can send a crafted request naming unauthorized records and receive their sensitive fields without victim interaction, even with no assigned roles.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read complete selling documents and requests for quotation outside their permitted scope, exposing valuation, margin, and other bidders.

The vulnerability exists due to missing record permission checks in ERPNext customer and supplier portal endpoints when requests specify records the caller is not authorized to read. An authenticated attacker can submit crafted requests, even with no assigned roles, and retrieve those records without victim interaction.


8) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated attacker to read Issues belonging to other customers in ERPNext, even with no assigned roles.

The vulnerability exists due to missing record-level authorization in the customer portal list endpoint when requests name Issues outside the caller's permitted customer scope. An authenticated attacker can send a crafted request naming those records and receive their data without victim interaction.


9) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker with the Sales User role to execute scripts in another user's session and act with that user's permissions.

The vulnerability exists due to missing HTML sanitization when saving notes on Leads and Opportunities in ERPNext's CRM module. An authenticated attacker with the Sales User role can save a crafted note whose payload executes when another user opens the record.


10) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user with the Accounts User role to obtain restricted document content and create Payment Requests against other companies' documents.

The vulnerability exists due to missing read permission and company validation in ERPNext's Accounts module when Payment Requests reference documents through the generic record interface. An authenticated user with the Accounts User role can reference an unreadable document and have its content emailed to an address they choose.


Remediation

Install update from vendor's website.

References