Executive brief
ERPNext, an open-source enterprise resource planning platform used to manage business processes like accounting and inventory, contains a security flaw in its authorization system. This vulnerability allows a logged-in user with limited permissions to modify sensitive business data and documents they should not be able to access. Exploitation could lead to unauthorized financial changes, data corruption, or a complete compromise of the business management system.
Technical details
A missing authorization vulnerability (CWE-862) exists in ERPNext prior to version 16.9.1. Certain API endpoints fail to perform adequate validation checks on user permissions before processing data modification requests. An attacker with low-privileged credentials can exploit this over the network to modify or delete documents across the system, potentially escalating their influence over the entire application environment (Scope: Changed). The vulnerability is addressed in version 16.9.1; no workarounds are available.
Affected products
- Frappe ERPNext < 16.9.1
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD