Missing Authorization in ERPNext - #VU163036
Published: November 9, 2026
Vulnerability identifier: #VU163036
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated low-privileged attacker with permission to create a BOM Update Log to replace bills of materials (BOMs) across an ERPNext site outside their authorized scope.
The vulnerability exists due to missing authorization checks in the Manufacturing module endpoint when replacing BOMs in assemblies that reference them. An authenticated low-privileged attacker can submit a crafted request naming two BOMs, causing every assembly using the first to use the second.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.122.0, 16.50.0