Missing Authorization in ERPNext - #VU163041
Published: November 9, 2026
Vulnerability identifier: #VU163041
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with no Accounts role to stop scheduled accounting jobs from completing in ERPNext.
The vulnerability exists due to missing authorization checks in the Accounts module endpoint that processes status changes for Period Closing Voucher jobs. An authenticated attacker with no Accounts role can send a request naming a scheduled job and change its status so it no longer runs.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.121.4, 16.36.0