Incorrect authorization in ERPNext - #VU163047
Published: November 9, 2026
Vulnerability identifier: #VU163047
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker to read Issues belonging to other customers in ERPNext, even with no assigned roles.
The vulnerability exists due to missing record-level authorization in the customer portal list endpoint when requests name Issues outside the caller's permitted customer scope. An authenticated attacker can send a crafted request naming those records and receive their data without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.124.0, 16.52.0