Missing Authorization Vulnerability in Frappe ERPNext
CVE-2026-124316

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
7 November 2026

What is CVE-2026-124316?

Frappe ERPNext prior to version 15.121.4 and 16.36.0 is affected by a missing authorization vulnerability that compromises document and company permission checks. This flaw allows authenticated users, including those without specific roles or portal accounts, to access and retrieve open Purchase-type Material Requests associated with other companies by simply supplying item codes. This security oversight can lead to unauthorized data exposure and potential manipulation, highlighting the importance of stringent authorization checks within enterprise resource planning systems.

Affected Version(s)

erpnext 0 < 15.121.4

erpnext 16.0.0-beta.1 < 16.36.0

erpnext 15.121.4

References

https://github.com/frappe/erpnext/security/advisories/GHS...
vendor-advisory
https://github.com/frappe/erpnext/commit/48635ee6b56a08dc...
patch
https://github.com/frappe/erpnext/commit/aea326869b4f7ba9...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Joost Grunwald (Edufort)
Shohruh Yo'ldoshov
diptanilsaha
.