CVE-2026-124316

Frappe ERPNext versions prior to 15.121.4 and 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.buying.utils.get_linked_material_requests method. The root cause is a lack of document or company permission checks, allowing authenticated users—including portal users or those wit...

EUVD-2026-119270

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can...

CVE-2026-124314

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.crm.utils.get_open_activities component. This vulnerability allows any authenticated user, including those with no specific roles or portal access, to perform unauthorized...

EUVD-2026-119269

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

EUVD-2026-119268

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.getopenactivities that exposes ToDo and Event records. Any authenticated user, including portal or no-role users, can supply arbitrary refdoctype and refdocname values to...

CVE-2026-124315

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are susceptible to a missing authorization vulnerability (CWE-862) in the get_bom_items and get_bom_diff methods. These methods are currently whitelisted, causing them to skip necessary BOM read permission checks. This allows any aut...

CVE-2026-124313

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are vulnerable to a missing authorization issue in the whitelisted get_linked_payments_for_doc method. This flaw allows any authenticated user, including portal users, to provide arbitrary company, doctype, and docname values. Conseq...

EUVD-2026-119273

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getlinkedpaymentsfordoc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocatio...

CVE-2026-119758

The ERPNext OCR app for Frappe/ERPNext (through version 1.1.1 ) is vulnerable to a missing authorization and path traversal vulnerability within the whitelisted read_document method. An authenticated user can provide a fully client-controlled path argument to read arbitrary server files, effectiv...

Frappe ERPNext Authorization Issues Vulnerability

Frappe ERPNext versions prior to 15.121.0 and 16.34.0 have an authorization issue vulnerability. This vulnerability stems from certain endpoints that modify states not performing appropriate authorization checks. Users with low privileges can call methods that alter states without writing,...

Frappe ERPNext Authorization Issues Vulnerability

Frappe ERPNext versions prior to 15.118.0 and versions 16.0.0 to 16.27.0 have an authorization issue. This issue arises because certain endpoints in the Sales Person-wise Transaction Summary report do not perform appropriate authorization checks. When a restricted authenticated user requests...

EUVD-2026-98058

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

EUVD-2026-98064

Frappe ERPNext before 15.103.0 and 16.x before 16.12.0 contains a stored cross-site scripting vulnerability because the names of certain records are not properly neutralized when rendered on some dashboards, tools, and portals. Authenticated attackers can craft malicious record names that execute...

EUVD-2026-98057

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assign...

EUVD-2026-98061

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being rendered without escaping. Attackers with write access to item master data can store malicious script in a record name that executes in the browser of any...

EUVD-2026-98062

Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a stored cross-site scripting vulnerability in a profile field that is rendered without escaping into portal pages. Low-privilege attackers can store malicious script in the field that executes in the browser of any administrator...

EUVD-2026-98063

Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role permits...

EUVD-2026-98065

Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive...

EUVD-2026-98059

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoint...

EUVD-2026-98060

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on record status changes. Authenticated low-privileged users can call these endpoints to modify data beyond their permitted...