Missing Authorization in Frappe ERPNext Affects Raw Material Access

CVE-2026-124315

What is CVE-2026-124315?

Frappe ERPNext versions prior to 15.121.4 and 16.36.0 present a significant security flaw due to inadequate authorization checks in the 'get_bom_items' and 'get_bom_diff' methods. This oversight permits any authenticated user, including those with minimal roles or portal access, to access highly sensitive information related to Bills of Materials (BOM). Specifically, users can query 'get_bom_items' with a BOM name, exposing detailed information about raw materials, including quantities, rates, and costs, thereby compromising the confidentiality of manufacturing data.

References