SB20261109185 - Missing Authorization in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109185

SB20261109185 - Missing Authorization in ERPNext

Published: November 9, 2026

Security Bulletin ID SB20261109185
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user with a common operational role to read stock quantities and stock values for warehouses excluded by their User Permissions.

The vulnerability exists due to missing record authorization checks in an ERPNext Stock module endpoint when processing requests for restricted warehouse records. An authenticated user with a common operational role can submit a crafted request naming those records and retrieve their stock balances without victim interaction.


Remediation

Install update from vendor's website.

References