EUVD-2026-119269

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to...

CVE-2026-124315

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 are susceptible to a missing authorization vulnerability (CWE-862) in the get_bom_items and get_bom_diff methods. These methods are currently whitelisted, causing them to skip necessary BOM read permission checks. This allows any aut...