Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
378 vulnerabilities by Frappe
CVE-2026-72911 (GCVE-0-2026-72911)
Vulnerability from nvd – Published: 2026-08-10 21:00 – Updated: 2026-08-13 15:51
VLAI
EPSS
VEX
Title
ERPNext: Possibility of server-side template injection due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:51 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/56458 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/5f6952b1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/88443e4a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/ecb6d48e… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.29.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:51:21.859979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:51:32.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.118.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.29.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:00:46.536Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7"
},
{
"name": "https://github.com/frappe/erpnext/pull/56458",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/56458"
},
{
"name": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28"
},
{
"name": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39"
},
{
"name": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.29.0"
}
],
"source": {
"advisory": "GHSA-qq49-v74j-hjh7",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Possibility of server-side template injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72911",
"datePublished": "2026-08-10T21:00:46.536Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-13T15:51:32.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72910 (GCVE-0-2026-72910)
Vulnerability from nvd – Published: 2026-08-10 20:57 – Updated: 2026-08-11 17:11
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised modification of master data due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:10 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55709 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2ae6451f… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/8c7a313a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/ba936eef… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:10:46.388344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:11:40.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.112.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:57:40.920Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645"
},
{
"name": "https://github.com/frappe/erpnext/pull/55709",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55709"
},
{
"name": "https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f2460",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f2460"
},
{
"name": "https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed2404",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed2404"
},
{
"name": "https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243ff8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243ff8"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.112.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.112.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-qpvh-75wh-j645",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised modification of master data due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72910",
"datePublished": "2026-08-10T20:57:40.920Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T17:11:40.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72909 (GCVE-0-2026-72909)
Vulnerability from nvd – Published: 2026-08-10 20:55 – Updated: 2026-08-11 13:27
VLAI
EPSS
VEX
Title
ERPNext: Broken Access Control on certain endpoints
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 13:25 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55696 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/b05abbc5… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c03a66a1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.23.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T13:25:55.297501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T13:27:35.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.112.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:55:06.168Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f"
},
{
"name": "https://github.com/frappe/erpnext/pull/55696",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55696"
},
{
"name": "https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2"
},
{
"name": "https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.112.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.112.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-p577-cxv9-h82f",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Broken Access Control on certain endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72909",
"datePublished": "2026-08-10T20:55:06.168Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T13:27:35.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72908 (GCVE-0-2026-72908)
Vulnerability from nvd – Published: 2026-08-10 20:51 – Updated: 2026-08-12 22:14
VLAI
EPSS
VEX
Title
ERPNext: Possibility of SQL injection due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 22:08 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55127 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2a91c722… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c45d2a34… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/f98975f5… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.20.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T22:08:04.272198Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T22:14:31.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.109.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:51:23.696Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8"
},
{
"name": "https://github.com/frappe/erpnext/pull/55127",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55127"
},
{
"name": "https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf"
},
{
"name": "https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2"
},
{
"name": "https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.109.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.109.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.20.0"
}
],
"source": {
"advisory": "GHSA-grhp-m55m-63f8",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Possibility of SQL injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72908",
"datePublished": "2026-08-10T20:51:23.696Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-12T22:14:31.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72907 (GCVE-0-2026-72907)
Vulnerability from nvd – Published: 2026-08-10 20:49 – Updated: 2026-08-13 15:50
VLAI
EPSS
VEX
Title
ERPNext: Broken Access Control on certain endpoint
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:49 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55665 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2d0e3fd9… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/37d2adc7… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c0cf9aa1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:49:56.650632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:50:03.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:49:26.987Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-94v6-784v-24q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-94v6-784v-24q5"
},
{
"name": "https://github.com/frappe/erpnext/pull/55665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55665"
},
{
"name": "https://github.com/frappe/erpnext/commit/2d0e3fd9af521e407be35fd09e9427176609513f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2d0e3fd9af521e407be35fd09e9427176609513f"
},
{
"name": "https://github.com/frappe/erpnext/commit/37d2adc74ba91f388194b3bbe07368c40573a9b2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/37d2adc74ba91f388194b3bbe07368c40573a9b2"
},
{
"name": "https://github.com/frappe/erpnext/commit/c0cf9aa1a7f95ee22b99ea1ca2a2cb09b314e67f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c0cf9aa1a7f95ee22b99ea1ca2a2cb09b314e67f"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-94v6-784v-24q5",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Broken Access Control on certain endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72907",
"datePublished": "2026-08-10T20:49:26.987Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-13T15:50:03.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72906 (GCVE-0-2026-72906)
Vulnerability from nvd – Published: 2026-08-10 20:47 – Updated: 2026-08-11 17:12
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised triggering of automated emails due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:12 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55781 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/18ca96c3… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/e15879ac… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:12:44.326551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:12:58.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:47:39.959Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8"
},
{
"name": "https://github.com/frappe/erpnext/pull/55781",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55781"
},
{
"name": "https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd"
},
{
"name": "https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-3x6c-gc4v-f5v8",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised triggering of automated emails due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72906",
"datePublished": "2026-08-10T20:47:39.959Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T17:12:58.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66000 (GCVE-0-2026-66000)
Vulnerability from nvd – Published: 2026-08-07 18:25 – Updated: 2026-08-07 18:39
VLAI
EPSS
VEX
Title
Frappe: Unrestricted access to Document Follow APIs
Summary
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/0914acb99… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/b02c1aec2… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:39:41.937802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:39:50.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.19.0"
},
{
"status": "affected",
"version": "\u003e= 15.0.0, \u003c 15.109.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient\u0027s current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:25:11.671Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-wcm9-vvcc-r8pr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-wcm9-vvcc-r8pr"
},
{
"name": "https://github.com/frappe/frappe/commit/0914acb998004b3878eb5cf57b765115305b49a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/0914acb998004b3878eb5cf57b765115305b49a6"
},
{
"name": "https://github.com/frappe/frappe/commit/b02c1aec2c75eb0819cc6730dd230c2acb0fa60d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/b02c1aec2c75eb0819cc6730dd230c2acb0fa60d"
}
],
"source": {
"advisory": "GHSA-wcm9-vvcc-r8pr",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unrestricted access to Document Follow APIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66000",
"datePublished": "2026-08-07T18:25:11.671Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-07T18:39:50.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66058 (GCVE-0-2026-66058)
Vulnerability from nvd – Published: 2026-08-07 17:54 – Updated: 2026-08-10 11:59
VLAI
EPSS
VEX
Title
Frappe: Unrestricted access to a Document Follow API
Summary
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user.
This issue is fixed in versions 16.20.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 11:59 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T11:59:24.484820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:59:36.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
},
{
"status": "affected",
"version": "\u003c 15.112.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user.\nThis issue is fixed in versions 16.20.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:54:09.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g"
}
],
"source": {
"advisory": "GHSA-fgx7-fvpx-mw3g",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unrestricted access to a Document Follow API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66058",
"datePublished": "2026-08-07T17:54:09.633Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-08-10T11:59:36.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66059 (GCVE-0-2026-66059)
Vulnerability from nvd – Published: 2026-08-07 15:21 – Updated: 2026-08-08 02:54
VLAI
EPSS
VEX
Title
Frappe: Field-level permission bypass via Document Follow
Summary
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-08 02:54 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/45dfd1432… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d6a214db9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-08T02:54:37.228091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T02:54:58.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
},
{
"status": "affected",
"version": "\u003c 15.112.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:21:51.134Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4"
},
{
"name": "https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4"
},
{
"name": "https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9"
}
],
"source": {
"advisory": "GHSA-7vpf-q96h-59x4",
"discovery": "UNKNOWN"
},
"title": "Frappe: Field-level permission bypass via Document Follow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66059",
"datePublished": "2026-08-07T15:21:51.134Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-08-08T02:54:58.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49391 (GCVE-0-2026-49391)
Vulnerability from nvd – Published: 2026-08-06 21:36 – Updated: 2026-08-07 17:21
VLAI
EPSS
VEX
Title
Frappe: Stored XSS in Column Headers via Data Import
Summary
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:21 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/002a36a26… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/2bf7b9d0b… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:21:21.190547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:21:30.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.19.0"
},
{
"status": "affected",
"version": "\u003c 15.109.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:36:24.520Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg"
},
{
"name": "https://github.com/frappe/frappe/commit/002a36a2668781366e4bf1ff144da5e53446f540",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/002a36a2668781366e4bf1ff144da5e53446f540"
},
{
"name": "https://github.com/frappe/frappe/commit/2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9"
}
],
"source": {
"advisory": "GHSA-7f28-gm9h-q6rg",
"discovery": "UNKNOWN"
},
"title": "Frappe: Stored XSS in Column Headers via Data Import"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49391",
"datePublished": "2026-08-06T21:36:24.520Z",
"dateReserved": "2026-05-29T19:08:01.256Z",
"dateUpdated": "2026-08-07T17:21:30.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47765 (GCVE-0-2026-47765)
Vulnerability from nvd – Published: 2026-08-06 21:25 – Updated: 2026-08-07 15:35
VLAI
EPSS
VEX
Title
Frappe: Lack of Permissions in restore/bulk_restore
Summary
Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/caa95f64f… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d5c5499c9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:35:06.319168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:35:24.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.110.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:25:31.501Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf"
},
{
"name": "https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e"
},
{
"name": "https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0"
}
],
"source": {
"advisory": "GHSA-cjjx-3v2x-37mf",
"discovery": "UNKNOWN"
},
"title": "Frappe: Lack of Permissions in restore/bulk_restore"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47765",
"datePublished": "2026-08-06T21:25:31.501Z",
"dateReserved": "2026-05-19T22:36:16.882Z",
"dateUpdated": "2026-08-07T15:35:24.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47194 (GCVE-0-2026-47194)
Vulnerability from nvd – Published: 2026-08-06 21:19 – Updated: 2026-08-07 17:11
VLAI
EPSS
VEX
Title
Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
Summary
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:11 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:11:31.037942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:11:41.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.18.3"
},
{
"status": "affected",
"version": "\u003c 15.108.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:19:19.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-3w78-3cj3-p949",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-3w78-3cj3-p949"
}
],
"source": {
"advisory": "GHSA-3w78-3cj3-p949",
"discovery": "UNKNOWN"
},
"title": "Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47194",
"datePublished": "2026-08-06T21:19:19.342Z",
"dateReserved": "2026-05-18T22:07:37.435Z",
"dateUpdated": "2026-08-07T17:11:41.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47185 (GCVE-0-2026-47185)
Vulnerability from nvd – Published: 2026-08-06 21:08 – Updated: 2026-08-07 17:13
VLAI
EPSS
VEX
Title
Frappe Has Broken Access Control in its Workspace Save API
Summary
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:13 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/8ef9e9076… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:13:24.132330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:13:44.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user\u0027s private workspace and persistent script injection. This issue is fixed in version 16.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:08:14.037Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x"
},
{
"name": "https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5"
}
],
"source": {
"advisory": "GHSA-mcr4-jc52-ww6x",
"discovery": "UNKNOWN"
},
"title": "Frappe Has Broken Access Control in its Workspace Save API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47185",
"datePublished": "2026-08-06T21:08:14.037Z",
"dateReserved": "2026-05-18T22:07:37.435Z",
"dateUpdated": "2026-08-07T17:13:44.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13227 (GCVE-0-2026-13227)
Vulnerability from nvd – Published: 2026-08-04 20:53 – Updated: 2026-08-05 14:44
VLAI
EPSS
VEX
Title
ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
Summary
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.
This issue affects ERPNext: before 15.115.0, before 16.26.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/es/advisories/kraviz | third-party-advisory |
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://github.com/frappe/erpnext/releases?page=2… | patch |
| https://github.com/frappe/erpnext | product |
| https://github.com/frappe/erpnext/releases?page=2… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:44:28.071979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:44:49.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/es/advisories/kraviz"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"product": "ERPNext",
"vendor": "Frappe",
"versions": [
{
"lessThan": "15.115.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "16.26.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eduardo Ferguson"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn Improper Authorization vulnerability exists in ERPNext version \u003ccode\u003e\u0026lt;v16.25.0 and \u0026lt;15.115.0 \u003c/code\u003e due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.\u003c/p\u003e\u003cp\u003eThis issue affects ERPNext: before 15.115.0, before 16.26.0.\u003c/p\u003e"
}
],
"value": "An Improper Authorization vulnerability exists in ERPNext version \u003cv16.25.0 and \u003c15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.\n\nThis issue affects ERPNext: before 15.115.0, before 16.26.0."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:53:53.785Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/es/advisories/kraviz"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-g8r3-82j6-wp48"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/releases?page=2#release-v15.115.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/erpnext"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/releases?page=2#release-v16.26.0"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ERPNext v16.25.0 - Improper authorization in Prospect opportunities API",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2026-13227",
"datePublished": "2026-08-04T20:53:53.785Z",
"dateReserved": "2026-06-24T16:42:20.788Z",
"dateUpdated": "2026-08-05T14:44:49.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-12895 (GCVE-0-2026-12895)
Vulnerability from nvd – Published: 2026-07-29 10:58 – Updated: 2026-07-29 12:07
VLAI
EPSS
VEX
Title
SQL Injection in Frappe's ERPNext
Summary
SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 12:07 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.incibe.es/en/incibe-cert/notices/avis… | patch |
Impacted products
Date Public
2026-07-29 10:53
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-12895",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T12:07:25.492403Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T12:07:55.509Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ERPNext",
"vendor": "Frappe",
"versions": [
{
"lessThan": "15.111.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "16.22.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alejandro Ramos"
}
],
"datePublic": "2026-07-29T10:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "SQL injection in Frappe\u0027s ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information."
}
],
"value": "SQL injection in Frappe\u0027s ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interpolation using `str.format()` without employing parameterized queries, allowing the name (docname) of a Supplier record containing SQL metacharacters to be interpreted as part of the query. Exploitation of this vulnerability could allow an authenticated user with low privileges to execute arbitrary SQL queries, bypass Frappe\u2019s access restrictions (DocPerm), extract confidential information from the database\u2014including fragments of the administrator\u2019s password hash\u2014and access other sensitive data, such as credentials, integration tokens, or financial information."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T10:58:50.322Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-frappes-erpnext"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0."
}
],
"value": "The vulnerability has been fixed by the Frappe team in versions 15.111.0 and 16.22.0."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "SQL Injection in Frappe\u0027s ERPNext",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-12895",
"datePublished": "2026-07-29T10:58:50.322Z",
"dateReserved": "2026-06-22T12:58:30.777Z",
"dateUpdated": "2026-07-29T12:07:55.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72911 (GCVE-0-2026-72911)
Vulnerability from cvelistv5 – Published: 2026-08-10 21:00 – Updated: 2026-08-13 15:51
VLAI
EPSS
VEX
Title
ERPNext: Possibility of server-side template injection due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.
Severity
9.9 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:51 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/56458 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/5f6952b1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/88443e4a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/ecb6d48e… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.29.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72911",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:51:21.859979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:51:32.962Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.118.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.29.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T21:00:46.536Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-qq49-v74j-hjh7"
},
{
"name": "https://github.com/frappe/erpnext/pull/56458",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/56458"
},
{
"name": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/5f6952b15c1f6ee893770d5bc618558a6ba41a28"
},
{
"name": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/88443e4a97c6c0a40d85a9e6785577191296ee39"
},
{
"name": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/ecb6d48ec025e0c94abac35b2e4f7607f4c86465"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.118.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.118.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.29.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.29.0"
}
],
"source": {
"advisory": "GHSA-qq49-v74j-hjh7",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Possibility of server-side template injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72911",
"datePublished": "2026-08-10T21:00:46.536Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-13T15:51:32.962Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72910 (GCVE-0-2026-72910)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:57 – Updated: 2026-08-11 17:11
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised modification of master data due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:10 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55709 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2ae6451f… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/8c7a313a… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/ba936eef… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72910",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:10:46.388344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:11:40.797Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.112.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:57:40.920Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645"
},
{
"name": "https://github.com/frappe/erpnext/pull/55709",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55709"
},
{
"name": "https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f2460",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f2460"
},
{
"name": "https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed2404",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed2404"
},
{
"name": "https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243ff8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243ff8"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.112.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.112.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-qpvh-75wh-j645",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised modification of master data due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72910",
"datePublished": "2026-08-10T20:57:40.920Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T17:11:40.797Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72909 (GCVE-0-2026-72909)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:55 – Updated: 2026-08-11 13:27
VLAI
EPSS
VEX
Title
ERPNext: Broken Access Control on certain endpoints
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 13:25 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55696 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/b05abbc5… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c03a66a1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.23.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72909",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T13:25:55.297501Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T13:27:35.018Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.112.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.23.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284: Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:55:06.168Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f"
},
{
"name": "https://github.com/frappe/erpnext/pull/55696",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55696"
},
{
"name": "https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2"
},
{
"name": "https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.112.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.112.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.23.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.23.0"
}
],
"source": {
"advisory": "GHSA-p577-cxv9-h82f",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Broken Access Control on certain endpoints"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72909",
"datePublished": "2026-08-10T20:55:06.168Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T13:27:35.018Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72908 (GCVE-0-2026-72908)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:51 – Updated: 2026-08-12 22:14
VLAI
EPSS
VEX
Title
ERPNext: Possibility of SQL injection due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-12 22:08 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55127 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2a91c722… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c45d2a34… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/f98975f5… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.20.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72908",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-12T22:08:04.272198Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-12T22:14:31.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.109.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue is fixed in versions 15.109.0 and 16.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:51:23.696Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-grhp-m55m-63f8"
},
{
"name": "https://github.com/frappe/erpnext/pull/55127",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55127"
},
{
"name": "https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf"
},
{
"name": "https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c45d2a348777a9bdf697832b6ca129d2f0626fd2"
},
{
"name": "https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/f98975f51a62d611f536368671c3dbaf81d61eb9"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.109.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.109.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.20.0"
}
],
"source": {
"advisory": "GHSA-grhp-m55m-63f8",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Possibility of SQL injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72908",
"datePublished": "2026-08-10T20:51:23.696Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-12T22:14:31.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72907 (GCVE-0-2026-72907)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:49 – Updated: 2026-08-13 15:50
VLAI
EPSS
VEX
Title
ERPNext: Broken Access Control on certain endpoint
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 15:49 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55665 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/2d0e3fd9… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/37d2adc7… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/c0cf9aa1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72907",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T15:49:56.650632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:50:03.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285: Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:49:26.987Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-94v6-784v-24q5",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-94v6-784v-24q5"
},
{
"name": "https://github.com/frappe/erpnext/pull/55665",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55665"
},
{
"name": "https://github.com/frappe/erpnext/commit/2d0e3fd9af521e407be35fd09e9427176609513f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/2d0e3fd9af521e407be35fd09e9427176609513f"
},
{
"name": "https://github.com/frappe/erpnext/commit/37d2adc74ba91f388194b3bbe07368c40573a9b2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/37d2adc74ba91f388194b3bbe07368c40573a9b2"
},
{
"name": "https://github.com/frappe/erpnext/commit/c0cf9aa1a7f95ee22b99ea1ca2a2cb09b314e67f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/c0cf9aa1a7f95ee22b99ea1ca2a2cb09b314e67f"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-94v6-784v-24q5",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Broken Access Control on certain endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72907",
"datePublished": "2026-08-10T20:49:26.987Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-13T15:50:03.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72906 (GCVE-0-2026-72906)
Vulnerability from cvelistv5 – Published: 2026-08-10 20:47 – Updated: 2026-08-11 17:12
VLAI
EPSS
VEX
Title
ERPNext: Unauthorised triggering of automated emails due to missing validation
Summary
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 17:12 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/frappe/erpnext/security/adviso… | x_refsource_CONFIRM |
| https://github.com/frappe/erpnext/pull/55781 | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/18ca96c3… | x_refsource_MISC |
| https://github.com/frappe/erpnext/commit/e15879ac… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v1… | x_refsource_MISC |
| https://github.com/frappe/erpnext/releases/tag/v16.22.0 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72906",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T17:12:44.326551Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T17:12:58.748Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "erpnext",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.111.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0, \u003c 16.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T20:47:39.959Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8"
},
{
"name": "https://github.com/frappe/erpnext/pull/55781",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/pull/55781"
},
{
"name": "https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd"
},
{
"name": "https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v15.111.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v15.111.0"
},
{
"name": "https://github.com/frappe/erpnext/releases/tag/v16.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/erpnext/releases/tag/v16.22.0"
}
],
"source": {
"advisory": "GHSA-3x6c-gc4v-f5v8",
"discovery": "UNKNOWN"
},
"title": "ERPNext: Unauthorised triggering of automated emails due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72906",
"datePublished": "2026-08-10T20:47:39.959Z",
"dateReserved": "2026-08-10T17:57:26.143Z",
"dateUpdated": "2026-08-11T17:12:58.748Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66000 (GCVE-0-2026-66000)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:25 – Updated: 2026-08-07 18:39
VLAI
EPSS
VEX
Title
Frappe: Unrestricted access to Document Follow APIs
Summary
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 18:39 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/0914acb99… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/b02c1aec2… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66000",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T18:39:41.937802Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:39:50.944Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.19.0"
},
{
"status": "affected",
"version": "\u003e= 15.0.0, \u003c 15.109.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient\u0027s current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:25:11.671Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-wcm9-vvcc-r8pr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-wcm9-vvcc-r8pr"
},
{
"name": "https://github.com/frappe/frappe/commit/0914acb998004b3878eb5cf57b765115305b49a6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/0914acb998004b3878eb5cf57b765115305b49a6"
},
{
"name": "https://github.com/frappe/frappe/commit/b02c1aec2c75eb0819cc6730dd230c2acb0fa60d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/b02c1aec2c75eb0819cc6730dd230c2acb0fa60d"
}
],
"source": {
"advisory": "GHSA-wcm9-vvcc-r8pr",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unrestricted access to Document Follow APIs"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66000",
"datePublished": "2026-08-07T18:25:11.671Z",
"dateReserved": "2026-07-23T18:54:15.833Z",
"dateUpdated": "2026-08-07T18:39:50.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-58375 (GCVE-0-2025-58375)
Vulnerability from cvelistv5 – Published: 2026-08-07 18:21 – Updated: 2026-08-07 18:21
VLAI
EPSS
VEX
Title
Frappe has potential SQL Injection due to missing validation
Summary
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0.
Severity
8.1 (High)
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/2dab009c8… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/ec70383ef… | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 14.96.10"
},
{
"status": "affected",
"version": "\u003e= 15.0.0, \u003c 15.72.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed in versions 14.96.10 and 15.72.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T18:21:10.445Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-mggw-6xqj-rphj"
},
{
"name": "https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/2dab009c8b15e29aa14bcd421eee8c6b2dc0fce6"
},
{
"name": "https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/ec70383ef0196d7b64fcf51b230483dac095a68b"
}
],
"source": {
"advisory": "GHSA-mggw-6xqj-rphj",
"discovery": "UNKNOWN"
},
"title": "Frappe has potential SQL Injection due to missing validation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2025-58375",
"datePublished": "2026-08-07T18:21:10.445Z",
"dateReserved": "2025-08-29T16:19:59.012Z",
"dateUpdated": "2026-08-07T18:21:10.445Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66058 (GCVE-0-2026-66058)
Vulnerability from cvelistv5 – Published: 2026-08-07 17:54 – Updated: 2026-08-10 11:59
VLAI
EPSS
VEX
Title
Frappe: Unrestricted access to a Document Follow API
Summary
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user.
This issue is fixed in versions 16.20.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-10 11:59 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66058",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-10T11:59:24.484820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:59:36.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
},
{
"status": "affected",
"version": "\u003c 15.112.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user.\nThis issue is fixed in versions 16.20.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639: Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:54:09.633Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-fgx7-fvpx-mw3g"
}
],
"source": {
"advisory": "GHSA-fgx7-fvpx-mw3g",
"discovery": "UNKNOWN"
},
"title": "Frappe: Unrestricted access to a Document Follow API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66058",
"datePublished": "2026-08-07T17:54:09.633Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-08-10T11:59:36.362Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-66059 (GCVE-0-2026-66059)
Vulnerability from cvelistv5 – Published: 2026-08-07 15:21 – Updated: 2026-08-08 02:54
VLAI
EPSS
VEX
Title
Frappe: Field-level permission bypass via Document Follow
Summary
Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-08 02:54 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/45dfd1432… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d6a214db9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-66059",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-08T02:54:37.228091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-08T02:54:58.969Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
},
{
"status": "affected",
"version": "\u003c 15.112.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:21:51.134Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7vpf-q96h-59x4"
},
{
"name": "https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/45dfd1432eb65581f90b8b0589e456e77a574fe4"
},
{
"name": "https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d6a214db952cf7010020889bbc00073cce88a0c9"
}
],
"source": {
"advisory": "GHSA-7vpf-q96h-59x4",
"discovery": "UNKNOWN"
},
"title": "Frappe: Field-level permission bypass via Document Follow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-66059",
"datePublished": "2026-08-07T15:21:51.134Z",
"dateReserved": "2026-07-23T23:25:28.896Z",
"dateUpdated": "2026-08-08T02:54:58.969Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-49391 (GCVE-0-2026-49391)
Vulnerability from cvelistv5 – Published: 2026-08-06 21:36 – Updated: 2026-08-07 17:21
VLAI
EPSS
VEX
Title
Frappe: Stored XSS in Column Headers via Data Import
Summary
Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:21 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/002a36a26… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/2bf7b9d0b… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-49391",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:21:21.190547Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:21:30.582Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.19.0"
},
{
"status": "affected",
"version": "\u003c 15.109.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:36:24.520Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-7f28-gm9h-q6rg"
},
{
"name": "https://github.com/frappe/frappe/commit/002a36a2668781366e4bf1ff144da5e53446f540",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/002a36a2668781366e4bf1ff144da5e53446f540"
},
{
"name": "https://github.com/frappe/frappe/commit/2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/2bf7b9d0b4c7f815de1c85695e9a027ecce8bed9"
}
],
"source": {
"advisory": "GHSA-7f28-gm9h-q6rg",
"discovery": "UNKNOWN"
},
"title": "Frappe: Stored XSS in Column Headers via Data Import"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-49391",
"datePublished": "2026-08-06T21:36:24.520Z",
"dateReserved": "2026-05-29T19:08:01.256Z",
"dateUpdated": "2026-08-07T17:21:30.582Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47765 (GCVE-0-2026-47765)
Vulnerability from cvelistv5 – Published: 2026-08-06 21:25 – Updated: 2026-08-07 15:35
VLAI
EPSS
VEX
Title
Frappe: Lack of Permissions in restore/bulk_restore
Summary
Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/caa95f64f… | x_refsource_MISC |
| https://github.com/frappe/frappe/commit/d5c5499c9… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47765",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T15:35:06.319168Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T15:35:24.116Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 15.110.0"
},
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization. This issue is fixed in versions 15.110.0 and 16.20.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862: Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:25:31.501Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-cjjx-3v2x-37mf"
},
{
"name": "https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/caa95f64f96ccf62f9f9fdfc03274527105cb44e"
},
{
"name": "https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/d5c5499c95953b0bb28f7b4907add01663bb8ca0"
}
],
"source": {
"advisory": "GHSA-cjjx-3v2x-37mf",
"discovery": "UNKNOWN"
},
"title": "Frappe: Lack of Permissions in restore/bulk_restore"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47765",
"datePublished": "2026-08-06T21:25:31.501Z",
"dateReserved": "2026-05-19T22:36:16.882Z",
"dateUpdated": "2026-08-07T15:35:24.116Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47194 (GCVE-0-2026-47194)
Vulnerability from cvelistv5 – Published: 2026-08-06 21:19 – Updated: 2026-08-07 17:11
VLAI
EPSS
VEX
Title
Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain
Summary
Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:11 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47194",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:11:31.037942Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:11:41.256Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003e= 16.0.0-beta.1, \u003c 16.18.3"
},
{
"status": "affected",
"version": "\u003c 15.108.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link. This issue is fixed in versions 15.108.0 and 16.18.3."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:19:19.342Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-3w78-3cj3-p949",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-3w78-3cj3-p949"
}
],
"source": {
"advisory": "GHSA-3w78-3cj3-p949",
"discovery": "UNKNOWN"
},
"title": "Frappe: Host header poisoning can redirect magic login links to an attacker-controlled domain"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47194",
"datePublished": "2026-08-06T21:19:19.342Z",
"dateReserved": "2026-05-18T22:07:37.435Z",
"dateUpdated": "2026-08-07T17:11:41.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-47185 (GCVE-0-2026-47185)
Vulnerability from cvelistv5 – Published: 2026-08-06 21:08 – Updated: 2026-08-07 17:13
VLAI
EPSS
VEX
Title
Frappe Has Broken Access Control in its Workspace Save API
Summary
Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-07 17:13 UTC
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/frappe/frappe/security/advisor… | x_refsource_CONFIRM |
| https://github.com/frappe/frappe/commit/8ef9e9076… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-47185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-07T17:13:24.132330Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-07T17:13:44.152Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "frappe",
"vendor": "frappe",
"versions": [
{
"status": "affected",
"version": "\u003c 16.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user\u0027s private workspace and persistent script injection. This issue is fixed in version 16.18.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T21:08:14.037Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/frappe/frappe/security/advisories/GHSA-mcr4-jc52-ww6x"
},
{
"name": "https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/frappe/frappe/commit/8ef9e9076293c3f567b734ac9b1b81e63b805ab5"
}
],
"source": {
"advisory": "GHSA-mcr4-jc52-ww6x",
"discovery": "UNKNOWN"
},
"title": "Frappe Has Broken Access Control in its Workspace Save API"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-47185",
"datePublished": "2026-08-06T21:08:14.037Z",
"dateReserved": "2026-05-18T22:07:37.435Z",
"dateUpdated": "2026-08-07T17:13:44.152Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-13227 (GCVE-0-2026-13227)
Vulnerability from cvelistv5 – Published: 2026-08-04 20:53 – Updated: 2026-08-05 14:44
VLAI
EPSS
VEX
Title
ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
Summary
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.
This issue affects ERPNext: before 15.115.0, before 16.26.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 14:44 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://fluidattacks.com/es/advisories/kraviz | third-party-advisory |
| https://github.com/frappe/erpnext/security/adviso… | vendor-advisory |
| https://github.com/frappe/erpnext/releases?page=2… | patch |
| https://github.com/frappe/erpnext | product |
| https://github.com/frappe/erpnext/releases?page=2… | patch |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-13227",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T14:44:28.071979Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T14:44:49.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://fluidattacks.com/es/advisories/kraviz"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux"
],
"product": "ERPNext",
"vendor": "Frappe",
"versions": [
{
"lessThan": "15.115.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThan": "16.26.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "15.115.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:windows:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:macos:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:frappe:erpnext:*:*:linux:*:*:*:*:*",
"versionEndExcluding": "16.26.0",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Eduardo Ferguson"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn Improper Authorization vulnerability exists in ERPNext version \u003ccode\u003e\u0026lt;v16.25.0 and \u0026lt;15.115.0 \u003c/code\u003e due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.\u003c/p\u003e\u003cp\u003eThis issue affects ERPNext: before 15.115.0, before 16.26.0.\u003c/p\u003e"
}
],
"value": "An Improper Authorization vulnerability exists in ERPNext version \u003cv16.25.0 and \u003c15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.\n\nThis issue affects ERPNext: before 15.115.0, before 16.26.0."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T20:53:53.785Z",
"orgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"shortName": "Fluid Attacks"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://fluidattacks.com/es/advisories/kraviz"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-g8r3-82j6-wp48"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/releases?page=2#release-v15.115.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/frappe/erpnext"
},
{
"tags": [
"patch"
],
"url": "https://github.com/frappe/erpnext/releases?page=2#release-v16.26.0"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ERPNext v16.25.0 - Improper authorization in Prospect opportunities API",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "84fe0718-d6bb-4716-a7e8-81a6d1daa869",
"assignerShortName": "Fluid Attacks",
"cveId": "CVE-2026-13227",
"datePublished": "2026-08-04T20:53:53.785Z",
"dateReserved": "2026-06-24T16:42:20.788Z",
"dateUpdated": "2026-08-05T14:44:49.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}