Missing Authorization Vulnerability in Frappe ERPNext

CVE-2026-124313

What is CVE-2026-124313?

Frappe ERPNext versions prior to 15.121.4 and 16.36.0 exhibit a missing authorization vulnerability within the 'get_linked_payments_for_doc' method. This flaw allows any authenticated user, including portal users, to manipulate the method with arbitrary inputs, enabling access to Payment Ledger Entry allocation data tied to other companies’ invoices and vouchers. Consequently, this vulnerability could lead to unauthorized data exposure and compromise sensitive financial information.

References