SB20261109179 - Multiple vulnerabilities in ERPNext

Main Vulnerability Database SB20261109179

SB20261109179 - Multiple vulnerabilities in ERPNext

Published: November 9, 2026 Updated: November 9, 2026

Security Bulletin ID SB20261109179

CSH Severity

Low

Patch available

YES

Number of vulnerabilities 8

Exploitation vector Remote access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 8 vulnerabilities.

1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated low-privileged attacker to stop, resume, or close Work Orders outside their permitted companies or records in ERPNext.

The vulnerability exists due to Manufacturing endpoints checking document-type write permission instead of authorization for each targeted Work Order. An authenticated low-privileged attacker with a Manufacturing role and Work Order write access can submit a crafted request naming another company's Work Order to change its status without victim interaction.

2) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated user with a Buying role and Purchase Order write access in ERPNext to close or reopen Purchase Orders outside their permitted companies or records.

The vulnerability exists due to the Buying module endpoint checking document-type permissions rather than individual Purchase Order permissions when processing status changes. An authenticated user can submit a crafted request naming another company's Purchase Order to change its status without victim interaction.

3) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated user with a Selling role and Sales Order write access to close or reopen Sales Orders outside their permitted companies or records.

The vulnerability exists due to missing record-level authorization in ERPNext's Selling module when processing requests to change Sales Order status. An authenticated user can submit a crafted request naming a restricted Sales Order to change its status without victim interaction.

4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker with no Accounts role to stop scheduled accounting jobs from completing in ERPNext.

The vulnerability exists due to missing authorization checks in the Accounts module endpoint that processes status changes for Period Closing Voucher jobs. An authenticated attacker with no Accounts role can send a request naming a scheduled job and change its status so it no longer runs.

5) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated user with a common operational role to read private e-invoice files belonging to other companies outside their permitted scope.

The vulnerability exists due to missing record-level authorization in ERPNext's Regional module endpoint, which checks only document-type permissions when returning e-invoice files. An authenticated user with a common operational role can submit a crafted request naming unauthorized records and retrieve their files without victim interaction.

6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker, including a user with no assigned roles, to read unauthorized POS Profile cashier lists in ERPNext.

The vulnerability exists due to missing record-level authorization checks in a POS endpoint when requests identify profiles outside the caller's permitted scope. An authenticated attacker can send a crafted request naming restricted profiles and receive their cashier lists without victim interaction.

7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker to read invoice and order item rows belonging to other companies without authorization.

The vulnerability exists due to missing document read permission checks in an ERPNext Accounts module endpoint when processing requests naming inter-company documents. An authenticated attacker can submit a crafted request naming another company's document and receive its item rows without victim interaction, even with a portal account or no assigned roles.

8) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an authenticated attacker, including a portal user or a user with no assigned roles, to read account balance histories across companies.

The vulnerability exists due to missing authorization checks on accounts and charts when an ERPNext Accounts module dashboard chart source processes balance history requests. An authenticated attacker can submit a crafted request naming an account outside their permitted scope and retrieve its balance history without victim interaction.

Remediation

Install update from vendor's website.

References