CVE-2026-124316

Frappe ERPNext versions prior to 15.121.4 and 16.36.0 are vulnerable to a missing authorization flaw in the erpnext.buying.utils.get_linked_material_requests method. The root cause is a lack of document or company permission checks, allowing authenticated users—including portal users or those wit...