Incorrect authorization in ERPNext - #VU163069
Published: November 9, 2026
Vulnerability identifier: #VU163069
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user with the Stock User role to reserve stock beyond Sales Order limits, compromising the integrity of Stock Reservation Entries.
The vulnerability exists due to missing validation in ERPNext's Stock module reservation endpoint when item rows belong to a different Sales Order. An authenticated user with the Stock User role can submit a crafted reservation request referencing another order's item row to bypass reservation limits.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.122.0, 16.50.0