Authorization Bypass in ERPNext Affects Financial Reports

CVE-2026-108373

What is CVE-2026-108373?

ERPNext, an open source Enterprise Resource Planning tool, has a significant vulnerability that allows unauthorized access to financial data. Specific endpoints in the Sales Person-wise Transaction Summary report do not enforce proper authorization checks. This oversight enables a role-limited authenticated user to fetch financial transaction rows without adhering to their document permissions. As a result, users can view sensitive financial information beyond their intended access. The vulnerability has been addressed in ERPNext versions 15.118.0 and 16.27.0. For details on the fix, refer to the following updates from the vendor.

References