Missing Authorization in ERPNext - #VU163017
Published: November 9, 2026
Vulnerability identifier: #VU163017
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privilege authenticated remote attacker to read sensitive tax and payment information belonging to other companies or outside their authorized scope.
The vulnerability exists due to missing authorization checks in ERPNext financial reporting endpoints when generating reports from user requests. A low-privilege authenticated remote attacker can submit a crafted reporting request to obtain unauthorized reports containing identifiers and financial totals without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.121.3, 16.35.0