Missing Authorization in ERPNext - #VU163020
Published: November 9, 2026
Vulnerability identifier: #VU163020
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker with low privileges to send unauthorized email carrying the organisation's sending identity.
The vulnerability exists due to missing authorization checks in an ERPNext email endpoint when processing caller-supplied recipients and message content. A remote authenticated attacker with low privileges can submit chosen recipients and content to the endpoint, causing messages to be sent through the site's configured outgoing email account.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.121.3, 16.35.0