CVE-2026-124316
Deferred Deferred - Pending Action

Frappe ERPNext Missing Authorization in Material Requests

Publication date: 2026-11-07

Last updated on: 2026-11-07

Assigner: VulnCheck

Description
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-07
Last Modified
2026-11-07
Generated
2026-11-07
AI Q&A
2026-11-07
EPSS Evaluated
N/A
NVD
CVE-2026-124316
EUVD
EUVD-2026-119270

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe erpnext to 15.121.4 (exc)
frappe erpnext From 16.0 (inc) to 16.36.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe ERPNext before versions 15.121.4 and 16.x before 16.36.0 has a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method. This method lacks document or company permission checks, allowing authenticated users, including portal users or those without roles, to supply item codes and retrieve open Purchase-type Material Requests belonging to other companies.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive purchase requests from other companies. Attackers could exploit it to gather confidential procurement data, including item details and company-specific purchase orders, potentially leading to data breaches or competitive intelligence gathering.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other privacy regulations by exposing sensitive procurement data across companies. Unauthorized access to purchase requests may violate data protection requirements for confidentiality and access controls.

Mitigation Strategies

Upgrade Frappe ERPNext to version 15.121.4 or later if using 15.x, or to version 16.36.0 or later if using 16.x. This addresses the missing authorization flaw in the whitelisted method.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...