CVE-2026-109377

Deferred Deferred - Pending Action

ERPNext Missing Authorization Exposes Stock Quantities

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-109377

Affected Vendors & Products

Vendor	Product	Version / Range
Frappe	ERPNext	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ERPNext versions 9.0.0 through 16.50.0 have a missing authorization flaw. Authenticated users, including those with customer portal access, can exploit whitelisted batch methods to view stock quantities across all warehouses. Methods like get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty expose per-warehouse item batch details without proper permission checks.

Detection Guidance

Check ERPNext logs for repeated calls to whitelisted batch methods like get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty. Monitor for unusual access patterns by authenticated users, including customer portal users, to stock quantity data.

Impact Analysis

Attackers could gather sensitive inventory data, enabling competitive intelligence or supply chain manipulation. Customer portal users might access unauthorized stock levels, undermining trust. Businesses risk financial losses from improper stock visibility or misuse of exposed data.

Compliance Impact

This vulnerability may violate data protection regulations by exposing sensitive inventory data without authorization. GDPR could be impacted if personal data is involved, while HIPAA may be relevant if stock data relates to healthcare supplies. Non-compliance risks fines and reputational damage.

Mitigation Strategies

Update ERPNext to the latest version to patch the missing authorization flaw. Restrict access to batch-related API endpoints by reviewing and tightening user permissions. Audit existing user roles to ensure only authorized personnel can access stock quantities.

Hi! I’m here to help you understand CVE-2026-109377. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70