Vulnerabilities

TI-2026-86616 CVE-2026-124316 · GHSA-5wjf-fvgv-583h

Missing authorization in Frappe ERPNext exposes material requests

LOW 23

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission che…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00218 Published 2026-11-07 Fixed in 15.121.4, 16.36.0 CWE-862

TI-2026-86615 CVE-2026-124315 · GHSA-66vp-2c6m-m4r6

Missing authorization in Frappe ERPNext get_bom_items exposes BOM costs

LOW 31

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00257 Published 2026-11-07 Fixed in 15.121.4, 16.36.0 CWE-862

TI-2026-86614 CVE-2026-124314 · GHSA-8ggh-cw83-mp5q

Missing authorization in Frappe ERPNext exposes CRM activity records

LOW 31

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in erpnext.crm.utils.get_open_activities that exposes ToDo and Event records.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00257 Published 2026-11-07 Fixed in 15.121.4, 16.36.0 CWE-862

TI-2026-86613 CVE-2026-124313 · GHSA-c3m9-x4pg-4p8g

Missing authorization in Frappe ERPNext exposes payment ledger data