Incorrect authorization in ERPNext - #VU163042
Published: November 9, 2026
Vulnerability identifier: #VU163042
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated desk user with an ordinary job role to read customer documents outside their permitted scope in ERPNext.
The vulnerability exists due to missing record-level authorization checks in print and portal views when requests specify customer documents excluded by User Permissions. An authenticated desk user with an ordinary job role can send a crafted request naming restricted records and receive their contents without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0