What is the CVSS score of CVE-2026-44442?

CVE-2026-44442 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of ERPNext are affected by CVE-2026-44442?

Organizations running ERPNext prior to version 16.9.1 face a critical data integrity risk, where authenticated employees can escalate privileges to modify data outside their assigned roles, violating…. A patch is available.

How to fix or mitigate CVE-2026-44442?

Within 24 hours: Inventory all ERPNext instances and identify those running versions prior to 16.9.1; restrict administrative access to essential personnel. Within 7 days: Deploy ERPNext 16.9.1 to staging environments, validate core functionality, then deploy to production. Within 30 days: Complete rollout to all instances; review access logs for unauthorized modifications and audit role-based access control configurations.

ERPNext CVE-2026-44442

EUVD-2026-30195 CRITICAL

Missing Authorization (CWE-862)

2026-05-13 GitHub_M

Authentication Bypass Erpnext

9.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 08:20 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

AnalysisAI

Privilege escalation in ERPNext versions prior to 16.9.1 allows authenticated low-privileged users to modify data outside their assigned role due to missing authorization checks on certain endpoints. The flaw carries a CVSS 9.9 score with scope change, but EPSS is only 0.04% and CISA SSVC reports no observed exploitation, indicating no public exploit identified at time of analysis. The vendor (Frappe) has released a patched version 16.9.1 alongside GHSA-cg5w-7g26-p3w9.

Technical ContextAI

ERPNext is the open-source ERP application built on the Frappe framework, used for finance, HR, manufacturing, and CRM workloads. The root cause class is CWE-862 (Missing Authorization), meaning specific server endpoints process privileged actions without re-checking that the authenticated user's role actually permits the requested operation. Because ERPNext relies on its DocType permission model to gate record-level reads and writes, an endpoint that bypasses this check effectively breaks the entire role-based access control surface for the affected actions. The CPE cpe:2.3:a:frappe:erpnext is confirmed by NVD as the affected product line.

RemediationAI

Upgrade to the vendor-released patch ERPNext 16.9.1 or later as described in https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9; this is the primary and only confirmed fix. If immediate upgrade is not possible, restrict who can obtain authenticated accounts on the instance by disabling self-service signup on the website/portal, removing unused low-privilege roles, and placing the ERPNext UI/API behind a VPN or SSO with conditional access - note these measures only reduce the attacker pool and do not close the underlying authorization gap. Audit recent changes to sensitive DocTypes (especially financial, user, and permission records) for unexpected modifications by low-privilege accounts before and after patching.