What is the CVSS score of CVE-2026-44448?

CVE-2026-44448 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44448?

Yes, a patch is available for CVE-2026-44448. Update the affected software to the latest version immediately.

ERPNext CVE-2026-44448

EUVD-2026-30199 MEDIUM

Missing Authorization (CWE-862)

2026-05-13 GitHub_M

Authentication Bypass Erpnext

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 11:18 vuln.today

Patch available

May 13, 2026 - 23:17 EUVD

DescriptionGitHub Advisory

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.

AnalysisAI

Insufficient authorization enforcement on specific ERPNext endpoints allows authenticated low-privilege users to read sensitive data beyond their permitted role and make limited unauthorized data modifications. Affecting all ERPNext deployments prior to 15.102.0 (v15 branch) and prior to 16.11.0 (v16 branch), an attacker holding any valid user account can invoke unprotected server-side endpoints to access restricted records or alter data outside their role scope. No public exploit code exists and SSVC confirms no active exploitation, but the high confidentiality impact (CVSS C:H) warrants prompt patching - particularly on internet-exposed ERPNext instances where low-privilege accounts may be broadly distributed.

Technical ContextAI

ERPNext is an open-source Enterprise Resource Planning platform developed by Frappe (CPE: cpe:2.3:a:frappe:erpnext). The root cause is CWE-862 (Missing Authorization): specific server-side API endpoints execute privileged operations without verifying that the requesting user's assigned role grants permission for that operation. ERPNext enforces access control through a role-based permission model where roles govern access to doctypes and actions; the affected endpoints bypass this check entirely, allowing any authenticated session to invoke them regardless of role assignment. The high attack complexity rating (AC:H) in the CVSS vector suggests exploitation is not trivial - likely requiring prior knowledge of specific endpoint paths or parameter structures rather than being generically scannable, which is consistent with SSVC's 'Automatable: no' assessment.

RemediationAI

Vendor-released patches are confirmed in ERPNext 15.102.0 (v15 branch) and ERPNext 16.11.0 (v16 branch); all affected deployments should upgrade to one of these versions as the primary remediation. The official advisory with upgrade instructions is at https://github.com/frappe/erpnext/security/advisories/GHSA-444j-g95x-5pqv and additional context is available via VulDB at https://vuldb.com/vuln/363783. For organizations unable to patch immediately, restrict ERPNext application access to trusted internal network segments or require VPN authentication before reaching the ERPNext web interface - this reduces the pool of accounts that could exploit the issue but does not eliminate insider threat risk. Additionally, audit and minimize role assignments to reduce the number of low-privilege accounts with active sessions, and review ERPNext application logs for anomalous cross-role data access patterns as a detection measure. Neither workaround eliminates the underlying authorization flaw and should be treated as temporary.