SB20261109180 - Multiple vulnerabilities in ERPNext
Published: November 9, 2026 Updated: November 12, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 vulnerabilities.
1) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated low-privileged attacker with permission to create a BOM Update Log to replace bills of materials (BOMs) across an ERPNext site outside their authorized scope.
The vulnerability exists due to missing authorization checks in the Manufacturing module endpoint when replacing BOMs in assemblies that reference them. An authenticated low-privileged attacker can submit a crafted request naming two BOMs, causing every assembly using the first to use the second.
2) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user with the Accounts User role to remove payment reconciliations for vouchers belonging to other companies or outside their permitted scope.
The vulnerability exists due to missing voucher authorization checks in the ERPNext Accounts module endpoint when processing unreconciliation requests. An authenticated user with the Accounts User role can submit a crafted request naming unauthorized vouchers if permitted to create Unreconcile Payment records, removing their reconciliation.
3) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user with a common operational role to read Bank Transaction amounts and bank accounts belonging to other companies outside their permitted scope.
The vulnerability exists due to missing record-level authorization checks in an ERPNext Accounts module endpoint when processing requests for specific records. An authenticated user with a common operational role can submit a crafted request naming unauthorized records and receive their data without victim interaction.
4) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker with the Accounts User role to alter voucher reconciliation outside their permitted scope.
The vulnerability exists due to missing voucher authorization checks in ERPNext's Accounts module when reconciling Bank Transactions against caller-specified vouchers. An authenticated attacker with the Accounts User role can submit a crafted request against a Bank Transaction they can edit to allocate vouchers belonging to other companies or outside their User Permissions.
5) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker to create unauthorized Serial No and Batch records in ERPNext, compromising inventory data integrity.
The vulnerability exists due to missing authorization checks in a Stock module endpoint that creates missing master records when checking whether an inventory number exists. An authenticated attacker can submit a crafted request containing a new inventory number to create the corresponding record despite lacking permission to create those master records.
6) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker to read ERPNext buying-portal records outside their permitted scope, even without assigned roles.
The vulnerability exists due to a supplier portal endpoint checking party names without party types or record permissions when a Customer and a Supplier share a name. An authenticated attacker can submit a crafted request referencing unauthorized records and retrieve their data without victim interaction.
7) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user with a common operational role to read site-wide stock value beyond their authorized scope.
The vulnerability exists due to missing record-level authorization checks in ERPNext's Stock dashboard chart endpoint when the caller has no permitted warehouses. An authenticated user with a common operational role can send a crafted request naming records outside their permitted scope and receive stock value data without victim interaction.
8) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user, including a portal user or a user with no assigned roles, to read other employees' costing and billing rates without permission.
The vulnerability exists due to missing record-level authorization checks in an ERPNext Projects module endpoint when employee rate records are requested. An authenticated user can send a crafted request naming records outside their permitted scope and retrieve those records' rates without victim interaction.
9) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated attacker, including a portal user or a user with no assigned roles, to read Serial No and Batch ledger records beyond their permissions.
The vulnerability exists due to missing record-level authorization checks when an ERPNext Stock module endpoint processes requests for ledger entries. An authenticated attacker can send a crafted request naming records outside their permitted scope and retrieve inventory data without victim interaction.
10) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user to read ERPNext Taxes and Charges Template configuration, including account heads and rates, outside their permitted scope.
The vulnerability exists due to missing record-level authorization checks in an Accounts module endpoint when requests identify templates the caller cannot read. An authenticated user can submit a crafted request naming unauthorized records and receive their configuration without victim interaction, even with no assigned roles.
11) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated low-privileged attacker to repost General Ledger entries in ERPNext without System Manager permissions.
The vulnerability exists due to missing authorization checks when an accounting voucher method in the Accounts module creates and submits a Repost Accounting Ledger document. An authenticated low-privileged attacker can remotely invoke the method on a voucher they can read, deleting and reposting its entries without victim interaction.
12) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a low-privileged authenticated attacker to read address details outside their permitted scope, including customer and supplier addresses.
The vulnerability exists due to missing authorization checks in ERPNext’s Accounts module when its Tax Rule selection endpoint receives a request identifying a party or Address. A low-privileged authenticated attacker can submit a crafted request, even with no assigned roles, to retrieve location details without victim interaction.
13) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated low-privileged attacker to compromise sales data integrity by creating POS Invoice Merge Logs outside their permitted role.
The vulnerability exists due to missing authorization checks in an ERPNext POS endpoint when processing requests to create POS Invoice Merge Logs. An authenticated low-privileged attacker can send a crafted request to create a log for invoices outside their permitted scope without victim interaction.
14) Missing Authorization (CVE-ID: N/A)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated remote attacker to read asset details outside their permitted scope in ERPNext.
The vulnerability exists due to missing record-level authorization checks in an Assets module endpoint when requests identify asset records the caller cannot read. An authenticated remote attacker can submit a crafted request, even using an account with no assigned roles, and retrieve those records without victim interaction.
15) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows an authenticated user with the Stock User role to reserve stock beyond Sales Order limits, compromising the integrity of Stock Reservation Entries.
The vulnerability exists due to missing validation in ERPNext's Stock module reservation endpoint when item rows belong to a different Sales Order. An authenticated user with the Stock User role can submit a crafted reservation request referencing another order's item row to bypass reservation limits.
16) Authorization bypass through user-controlled key (CVE-ID: N/A)
CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose subscription status and subscription plan details for invoices outside their permitted scope.
The vulnerability exists due to missing record-level authorization checks in the ERPNext Accounts module endpoint when retrieving subscription plans for a caller-named invoice. A remote user can send a crafted request naming an invoice they cannot read to obtain its subscription status and plan details.
Remediation
Install update from vendor's website.
References
- https://github.com/frappe/erpnext/security/advisories/GHSA-77q9-p3mx-p357
- https://github.com/frappe/erpnext/security/advisories/GHSA-v3gf-jphf-f4xp
- https://github.com/frappe/erpnext/security/advisories/GHSA-qrv3-vxh2-xx3g
- https://github.com/frappe/erpnext/security/advisories/GHSA-9jx6-f65v-r6h7
- https://github.com/frappe/erpnext/security/advisories/GHSA-4mg4-7qq3-phxc
- https://github.com/frappe/erpnext/security/advisories/GHSA-xmw8-rg38-x88j
- https://github.com/frappe/erpnext/security/advisories/GHSA-6xf4-gr7h-2h57
- https://github.com/frappe/erpnext/security/advisories/GHSA-7455-jhmp-j2h2
- https://github.com/frappe/erpnext/security/advisories/GHSA-gqm4-wpw8-qrc9
- https://github.com/frappe/erpnext/security/advisories/GHSA-x6mc-x6wm-h5jc
- https://github.com/frappe/erpnext/security/advisories/GHSA-fjj8-qq2m-h96w
- https://github.com/frappe/erpnext/security/advisories/GHSA-8mhv-pfp8-m66q
- https://github.com/frappe/erpnext/security/advisories/GHSA-5jjr-hp7q-gmwr
- https://github.com/frappe/erpnext/security/advisories/GHSA-42cf-qgvq-xv9h
- https://github.com/frappe/erpnext/security/advisories/GHSA-x2f8-27qm-r3hf
- https://github.com/frappe/erpnext/security/advisories/GHSA-chqg-f85c-wxr7