Missing Authorization in ERPNext - #VU163057
Published: November 9, 2026
Vulnerability identifier: #VU163057
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged authenticated attacker to read address details outside their permitted scope, including customer and supplier addresses.
The vulnerability exists due to missing authorization checks in ERPNext’s Accounts module when its Tax Rule selection endpoint receives a request identifying a party or Address. A low-privileged authenticated attacker can submit a crafted request, even with no assigned roles, to retrieve location details without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.122.0, 16.50.0