Authorization Bypass in ERPNext by Frappe
CVE-2026-44448

5.9MEDIUM

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
13 May 2026

What is CVE-2026-44448?

ERPNext, an open-source Enterprise Resource Planning tool by Frappe, has a security vulnerability where certain endpoints did not enforce proper authorization checks. This oversight allowed users to modify data beyond their permitted roles, potentially leading to unauthorized access and data integrity issues. The vulnerability has been addressed in versions 15.102.0 and 16.11.0.

Affected Version(s)

erpnext >= 16.0.0-beta.1, < 16.11.0 < 16.0.0-beta.1, 16.11.0

erpnext < 15.102.0 < 15.102.0

References

https://github.com/frappe/erpnext/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.