Authorization bypass through user-controlled key in ERPNext - #VU163030
Published: November 9, 2026
Vulnerability identifier: #VU163030
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-639
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to read asset depreciation data belonging to companies they are not permitted to access.
The vulnerability exists due to missing asset read authorization checks in ERPNext Assets module endpoints when resolving depreciation schedules from caller-supplied assets. An authenticated attacker can submit a request naming another company's asset to retrieve its purchase value, depreciated value, and depreciation entries without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0