EUVD-2026-98057
GHSA-pvq6-r4wx-77pr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged ERPNext account
-
ExploitSend crafted request to inventory endpoint
-
ExecutionBypass missing role permission check
-
ImpactModify inventory records beyond role
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated ERPNext account of any role (CVSS PR:L); it is not exploitable by anonymous/unauthenticated attackers. The attacker must send requests directly to the specific inventory-record endpoints that omit permission enforcement, targeting ERPNext versions before 15.110.0 or 16.x before 16.21.0. Limiting factors: a working user session is mandatory, impact is confined to inventory data integrity (no data disclosure or service disruption), and patched versions (15.110.0 / 16.21.0) fully remove the exposure. No user interaction or non-default configuration is required. |
| Impact | This is a moderate-priority authorization flaw (CVSS 4.0 base 7.1) rather than a critical emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation requiring a low-privileged authenticated account - so this is an insider or compromised-credential threat, not a pre-auth remote compromise. Impact is narrow: VI:H with VC:N and VA:N means integrity-only (inventory data tampering) with no confidentiality or availability loss. No EPSS score was provided, the CVE is NOT in CISA KEV, and no POC was supplied, so there is no evidence of active or widespread exploitation - exploitation status is 'no public exploit identified at time of analysis.' There are no conflicting signals: the CVSS vector, CWE-862 (missing authorization), and the description all agree this is a post-authentication privilege-enforcement gap. The practical risk is elevated in multi-tenant or multi-role ERPNext deployments where many low-trust users hold accounts, and lower where account access is tightly restricted. |
| Exploit ScenarioDerived | A legitimate but low-privileged ERPNext user (for example, a sales or support account without inventory-management rights) crafts direct API requests to the affected inventory endpoints, which fail to re-check role permissions. The user alters stock quantities, warehouse records, or item data beyond their assigned role, enabling inventory fraud or data corruption. No public exploit code was identified, and exploitation requires a valid authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Frappe ERPNext fails to enforce permission checks on certain inventory-record endpoints, letting any authenticated user - regardless of assigned role - modify stock and inventory data they should not be able to touch. The flaw affects releases before 15.110.0 and 16.x before 16.21.0, requires a valid ERPNext session (CVSS PR:L, not anonymous), and impacts data integrity only: there is no disclosure of records and no denial of service. It is a moderate-priority authorization defect rather than a critical emergency, and no public exploit code has been identified at time of analysis; vendor fixes are available in 15.110.0 and 16.21.0. EPSS and CISA KEV data were not provided, so active exploitation is not confirmed.
RemediationAI
Upgrade to the fixed releases: ERPNext 15.110.0 for the 15.x branch or ERPNext 16.21.0 for the 16.x branch - vendor-released patches, tracked in GitHub Security Advisory GHSA-6rgf-xx2m-fjr2 and detailed in the VulnCheck advisory https://www.vulncheck.com/advisories/frappe-erpnext-before-15.110.0-missing-authorization-in-inventory-record-endpoints. If immediate upgrade is not possible, compensating controls include restricting network access to the affected inventory endpoints (for example by blocking or IP-allowlisting the relevant Frappe REST routes at a reverse proxy or WAF, at the cost of breaking legitimate programmatic inventory integrations), tightening Frappe role and user-permission assignments so that only trusted roles hold inventory write permissions (which limits blast radius but does not close the flaw for those roles), and enabling Frappe/ERPNext audit logging with alerting on unexpected Stock Entry, Warehouse or Bin modifications to detect abuse of the missing check. Because exploitation requires a valid authenticated account, prompt review and revocation of stale, shared or over-privileged ERPNext logins reduces exposure while the patch is staged. Note that patched versions 15.110.0 and 16.21.0 fully remove the exposure, so any workaround should be considered temporary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ERPNext is an open-source ERP built on the Frappe framework, where documents ("DocTypes") such as Stock Entry, Warehouse, Item and Bin are exposed through REST-style whitelisted endpoints and are normally protected by Frappe's role-based permission layer (frappe.has_permission checks mapped to role permissions, user permissions and permission levels). CWE-862 (Missing Authorization) describes exactly the observed failure: the affected inventory endpoints omit those permission checks, so the application authenticates the caller but never verifies that the caller's role permits the write. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) confirms network reachability, low attack complexity, a requirement for a low-privileged authenticated account, no user interaction, and a purely integrity-focused impact confined to the vulnerable system. The independent assessment's CVSS 3.1 equivalent (S:U/C:N/I:H/A:N) matches this scope. The supplied CPE (cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*) is a version-agnostic wildcard, so the authoritative affected boundary is the version range stated in the vendor advisory GHSA-6rgf-xx2m-fjr2.
Know when Frappe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint exploitable by any authenticated low-privileged user (PR:L, AC:L), yielding integrity-only impact on inventory data (I:H) with no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond what their assigned role permits.
Technical POC Analysis
The defect is CWE-862 (Missing Authorization).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ERPNext instances running releases before 15.110.0 or 16.x before 16.21.0 do not enforce role-based permission checks on certain inventory-record endpoints, so any user who can log in - regardless of their assigned role - can alter stock and inventory data they were never meant to touch. The exposure is data integrity rather than theft or outage: records are not exposed and systems stay available, but inventory and the financial reporting, forecasting, and procurement processes built on it can be silently corrupted by insiders, contractors, or any compromised low-privilege account. Leadership should treat this as a manageable but real integrity and reporting risk, since the affected population is broad (every authenticated user) while the blast radius is limited to inventory accuracy; remediation is available in maintained releases 15.110.0 and 16.21.0.
Apply vendor patch (15.110.0 / 16.21.0) once validated against the vendor advisory. Until upgrades are complete: restrict access to affected inventory endpoints to trusted networks or roles at the proxy/network layer; reduce the number of accounts holding valid ERPNext sessions and disable dormant accounts; enable detailed logging and alerting on inventory and stock-adjustment writes and review those logs daily; enforce segregation of duties by requiring a second approver for stock adjustments; and reconcile inventory records against physical counts or upstream systems to detect tampering. No public exploit code was identified at time of analysis and active exploitation is not confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored cross-site scripting leading to code execution in Frappe Framework 15.89.0 (and the ERPNext application built on
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
An exploitable SQL injection vulnerability exists in the authenticated part of ERPNext v10.1.6. Rated high severity (CVS
Authenticated SQL injection in Frappe ERPNext through 15.89.0 allows low-privilege users to extract arbitrary database c
SQL injection in Frappe ERPNext through 15.89.0 lets an authenticated attacker with a valid session and access to the Pa
Authenticated server-side template injection in Frappe ERPNext through 15.89.0 lets a user who can create or modify an A
An SQL injection vulnerability exists in the frappe.desk.reportview.get functionality of ERPNext 11.1.38. Rated high sev
Arbitrary file read in the Frappe full-stack web application framework allows remote unauthenticated attackers to retrie
SQL injection in Frappe HelpDesk 1.14.0 dashboard functionality allows authenticated attackers to execute arbitrary SQL
In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/re
Exploit-DB