CVE-2026-72909

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

CVE-2026-72909

ERPNext vulnerability CVE-2026-72909 affects the ReceivablePayableReport path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py. The issue is that the prepare_conditions logic fails to apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party ...

CVE-2026-72909 ERPNext: Broken Access Control on certain endpoints

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger...

EUVD-2026-55634

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

PT-2026-69977

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.112.0 ERPNext versions prior to 16.23.0 Description An issue exists in the prepare conditions path of the ReceivablePayableReport within erpnext/accounts/report/accounts receivable/accounts receivable.py. The syste...

CVE-2026-71242

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251 Akaunting - Cross-Company Media IDOR in Customer Portal Download Endpoint

Akaunting's shared download route app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/id/download behind only generic auth middleware fetched the requested Media record by ID with no verification that it belonged to the requesting portal customer's own company, allowing any...

CVE-2026-71251

CVE-2026-71251 (Akaunting) : The shared download route app/Http/Controllers/Common/Uploads.php::download() allowed an authenticated portal customer to fetch any Media by ID without verifying ownership. This constitutes a cross-company IDOR: a user could download another company’s uploaded files b...

CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

EUVD-2026-53315

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-hasCompany$model-companyid. NotesController's show, update, and destroy actions authori...

CVE-2026-71242 Crater - Cross-Company IDOR on Notes via Missing Company-Ownership Check in NotePolicy

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify -hasCompany-companyid. Any authenticated user of one company can read, edit, or delete anothe...

CVE-2026-71242

Crater's NotePolicy checks only a blanket Bouncer ability manage-all-notes / view-all-notes with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user-hasCompany$model-companyid. NotesController's show, update, and destroy actions authori...

CVE-2026-71242

Crater vulnerability CVE-2026-71242 exposes cross-company IDOR in notes. The NotePolicy uses a blanket manage/view notes check without company ownership verification, unlike other policies that call hasCompany(model->company_id). NotesController actions (show, update, destroy) authorize withou...

CVE-2026-55739

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

CVE-2026-55739 Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

CVE-2026-55739 Crater - Missing Tenant-Ownership Check in CustomerPolicy Allows Cross-Company Customer Data Theft and Deletion

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and -hasCompany-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability. Route-model-bound custome...

CVE-2026-55739

CVE-2026-55739 (Crater) : The vulnerability arises from a missing tenant-ownership check in CustomerPolicy where view/update/delete do not verify company ownership, plus unscoped route-model lookups and bulk deletion (self::find($id)) that ignore company filters. As a result, any authenticated us...

EUVD-2026-53194

Crater isolates data per companyid, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and $user-hasCompany$model-companyid. CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the blanket ability...