What is the CVSS score of CVE-2026-55242?

CVE-2026-55242 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ERPNext are affected by CVE-2026-55242?

Frappe ERPNext versions prior to 15.111.0 and 16.22.0 contain a server-side template injection vulnerability that allows standard operational users to bypass role-based access controls and view data…. A patch is available.

How to fix or mitigate CVE-2026-55242?

Within 24 hours, identify all ERPNext instances and document which are running versions before 15.111.0 or 16.22.0; review access logs for suspicious activity from operational users in configuration fields. Within 7 days, upgrade all affected ERPNext instances to version 15.111.0 or 16.22.0 or later, and perform post-upgrade testing of role-based access controls. Within 30 days, conduct a full audit of operational user permissions in ERPNext, implement template injection detection in configuration field monitoring, and validate that standard operational roles cannot write to template-injectable fields.

ERPNext CVE-2026-55242

EUVD-2026-44704 HIGH

Incorrect Authorization (CWE-863)

2026-07-15 GitHub_M

Authentication Bypass Erpnext Frappe

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Web-facing authenticated field yields AV:N/AC:L/PR:L/UI:N; the described impact is cross-scope data disclosure (S:C, C:H) with only incidental integrity and no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 15, 2026 - 17:48 EUVD

Analysis Generated

Jul 15, 2026 - 16:17 vuln.today

CVE Published

Jul 15, 2026 - 15:38 cve.org

HIGH 8.8

DescriptionCVE.org

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

AnalysisAI

Server-side template injection in Frappe ERPNext (versions before 15.111.0 and 16.22.0) lets an authenticated user holding only a standard operational role inject a malicious template payload into a configuration field, causing the server to render it and disclose data the user is not authorized to see. Because the flaw is rooted in an authorization failure (CWE-863), it effectively bypasses ERPNext's role/permission boundaries. No public exploit identified at time of analysis, and it is not listed in CISA KEV; a fixed release is available from the vendor.

Technical ContextAI

ERPNext is an open-source ERP platform built on the Frappe framework, which uses Jinja-style server-side templating to render configurable fields and print/format strings. When user-controllable input in a configuration field is passed into the template engine without proper sandboxing or authorization checks, an attacker can supply template expressions that execute in the server context - a classic server-side template injection. The assigned weakness, CWE-863 (Incorrect Authorization), indicates the core defect is that the rendered evaluation runs with access broader than the acting user's assigned role, allowing retrieval of records outside their permission scope. The affected component is identified by CPE cpe:2.3:a:frappe:erpnext across all versions prior to the fixed releases.

RemediationAI

Vendor-released patch: upgrade to ERPNext 15.111.0 if on the 15.x branch, or to 16.22.0 if on the 16.x branch, per advisory GHSA-pxf3-4gvc-v45j (https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j). Until the upgrade is applied, reduce exposure by tightening role permissions so that standard operational users cannot write to the configuration/template field involved, auditing which roles can edit templated configuration fields, and monitoring for template metacharacters (such as {{ }} or {% %}) submitted into those fields - note that restricting these permissions may disrupt legitimate users who normally customize those fields, so validate against your workflow before enforcing. Upgrading is strongly preferred, as configuration-field lockdown is a partial control that does not remove the underlying template evaluation flaw.