ERPNext EUVD-2026-30199

Exploitation requires a valid ERPNext user account with at minimum low-privilege role access, confirmed by CVSS PR:L - anonymous or unauthenticated access is not sufficient. The vulnerability is triggered by targeting specific API endpoints that lack authorization checks; the exact endpoint paths are not publicly disclosed in available data, which partly accounts for the high attack complexity (AC:H) rating. Exploitation is additionally constrained by: SSVC confirming the attack is not automatable (no known scanning or exploitation tooling exists); the attacker must have prior knowledge of the vulnerable endpoint paths and valid request formats; and scope is limited to the affected ERPNext instance (S:U, no lateral movement across systems implied). There is no indication that any special non-default configuration is required - the flaw is present in standard ERPNext deployments prior to the fixed versions, but the authentication prerequisite and high complexity meaningfully limit the realistic attacker population.

The CVSS base score of 5.9 (Medium) reflects a genuine but bounded risk: the attack vector is network (AV:N), but exploitation requires authentication (PR:L) and carries high complexity (AC:H), substantially limiting opportunistic or automated abuse. The impact profile is asymmetric - high confidentiality (C:H) but only low integrity impact (I:L) and no availability impact - meaning attackers can read sensitive business data more readily than they can corrupt it. EPSS at 0.03% (8th percentile) is very low and fully consistent with SSVC's 'Exploitation: none' and 'Automatable: no' findings; this is not a mass-exploitation target at present. A notable discrepancy exists between the intelligence tag 'Authentication Bypass' and the CVSS PR:L vector: CVSS confirms authentication IS required, making this a role-based authorization bypass (CWE-862) rather than an authentication bypass - defenders should not treat this as an unauthenticated exposure. The SSVC 'Technical Impact: partial' rating aligns with the scoped nature of the data access. Overall this is a real but non-urgent medium-severity issue, prioritized for organizations with untrusted internal users, shared low-privilege accounts, or regulatory sensitivity around ERP data.

An authenticated ERPNext user assigned a restricted role - such as a sales representative or inventory clerk - directly invokes one of the insufficiently-protected API endpoints using a crafted HTTP request with knowledge of the endpoint path and required parameters, bypassing the platform's role-based authorization check. The attacker successfully reads confidential business records outside their permitted scope, such as financial ledgers, HR data, or customer PII, and may make limited unauthorized modifications to records they would not normally be able to edit. No public exploit code exists at time of analysis, and the high attack complexity (AC:H) indicates the attacker likely requires prior reconnaissance of endpoint structure or internal knowledge of the ERPNext API.