Missing Authorization in ERPNext - #VU163043
Published: November 9, 2026
Vulnerability identifier: #VU163043
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user to read Sales Order line items in ERPNext beyond their permitted scope, including with no assigned roles.
The vulnerability exists due to missing record-level authorization checks in a Selling module endpoint when requests specify Sales Orders the caller cannot read. An authenticated user can submit a crafted request naming those records and receive their line items without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0