Missing Authorization in ERPNext - #VU163039
Published: November 9, 2026
Vulnerability identifier: #VU163039
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with the Accounts User role to alter voucher reconciliation outside their permitted scope.
The vulnerability exists due to missing voucher authorization checks in ERPNext's Accounts module when reconciling Bank Transactions against caller-specified vouchers. An authenticated attacker with the Accounts User role can submit a crafted request against a Bank Transaction they can edit to allocate vouchers belonging to other companies or outside their User Permissions.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.122.0, 16.50.0