CVE-2026-108373

Deferred Deferred - Pending Action

Authorization Bypass in ERPNext Financial Reports

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-108373

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	< 15.118.0
frappe	erpnext	>= 16.0.0, < 16.27.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ERPNext is an open-source Enterprise Resource Planning tool. A vulnerability exists in versions before 15.118.0 and 16.27.0 where certain report endpoints fail to enforce proper authorization checks. Specifically, the Sales Person-wise Transaction Summary report allows role-limited users to query financial data beyond their permitted access by bypassing document permission conditions.

Detection Guidance

To detect this vulnerability, check if your ERPNext instance is running a vulnerable version (prior to 15.118.0 or 16.27.0). Verify if role-limited users can access financial data beyond their permissions by testing report endpoints for unauthorized data exposure.

Impact Analysis

This vulnerability allows authenticated users with limited roles to access unauthorized financial data. Attackers could exploit this to read sensitive financial transactions they are not permitted to view, potentially leading to data breaches or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access to financial data, violating data protection regulations like GDPR (General Data Protection Regulation) or HIPAA (Health Insurance Portability and Accountability Act). Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade ERPNext to version 15.118.0 or 16.27.0 or later to fix the authorization flaw in the Sales Person-wise Transaction Summary report.

Hi! I’m here to help you understand CVE-2026-108373. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70