CVE-2026-108374

Deferred Deferred - Pending Action

Authorization Bypass in ERPNext

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-108374

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	< 15.121.0
frappe	erpnext	>= 16.0.0, < 16.34.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ERPNext is an open-source Enterprise Resource Planning tool. A vulnerability exists in versions before 15.121.0 and 16.34.0 where certain endpoints for status modification do not enforce proper authorization checks. This allows low-privileged authenticated users to invoke state-changing methods without required permissions like write, submit, or cancel checks. As a result, users can modify data beyond their permitted role.

Detection Guidance

To detect this vulnerability, check ERPNext versions for 15.121.0 or 16.34.0 or later. Verify if low-privileged users can modify data beyond their role permissions. Inspect server logs for unauthorized state-changing method invocations by authenticated users.

Impact Analysis

This vulnerability allows low-privileged users to modify data they should not have access to, potentially leading to unauthorized changes in ERPNext. This could result in data corruption, incorrect financial records, or unauthorized access to sensitive information, depending on the user's role and permissions.

Compliance Impact

This vulnerability could lead to unauthorized data modifications or access, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized changes to sensitive data could result in data breaches, loss of integrity, or non-compliance with data protection standards.

Mitigation Strategies

Update ERPNext to version 15.121.0 or 16.34.0 or later to fix the authorization bypass issue.

Hi! I’m here to help you understand CVE-2026-108374. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70