ERPNext EUVD-2026-30195

Requires a valid authenticated session on the ERPNext instance (CVSS PR:L) - any account, including low-privilege portal/customer roles, appears sufficient since the flaw is missing authorization rather than missing authentication. No user interaction is needed (UI:N) and the attack is performed over the network (AV:N) at low complexity (AC:L). Exploitation is limited to ERPNext versions prior to 16.9.1 running on the Frappe stack, and to the specific (publicly unenumerated) endpoints that lack the role check; instances that block external account creation and tightly control role assignment significantly shrink the attacker population, though insiders remain in scope.

Signals here conflict and need careful weighting. The CVSS 9.9 with AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a network-reachable, low-complexity flaw requiring only minimal authentication, with scope change pushing impact across security boundaries. However, EPSS is 0.04% (12th percentile) and CISA's SSVC marks Exploitation as none and Automatable as no, while Technical Impact is total. The discrepancy between the very high CVSS and the very low EPSS suggests this is a theoretically severe but not yet weaponized issue - realistic risk depends heavily on whether the ERPNext instance allows untrusted user registration (e.g., customer portal, self-serve signup) since PR:L means any valid account is sufficient. Internet-exposed ERPNext deployments with open signup or many low-trust users should treat this as high priority; isolated internal deployments have more breathing room. No KEV listing and no public POC reduce urgency relative to the headline score.

An attacker who registers or compromises a low-privilege ERPNext account (e.g., a customer or portal user) sends crafted requests directly to the vulnerable endpoints to modify records their role should not be able to touch, such as elevating their own permissions, altering financial documents, or tampering with master data. Because the scope is changed and integrity impact is high, this single foothold can pivot into full administrative control of the ERP instance. No public exploit identified at time of analysis, but the conditions are simple enough that exploitation by a knowledgeable user is plausible.