ERPNext EUVD-2026-52924

Exploitation requires a valid ERPNext user account with at minimum a low-privilege role that permits session authentication to the application - the CVSS PR:L metric confirms this prerequisite. The vulnerable endpoint is the CRM-specific API method get_opportunities within the Prospect doctype; the CRM module must be in use and prospects must exist in the system for data to be disclosed. No special non-default configuration is required beyond having CRM functionality active, which is a standard ERPNext deployment. Exploitation is limited to confidentiality impact only - no write or destructive capability is exposed. External unauthenticated attackers cannot exploit this directly; a compromised or malicious internal account is the primary threat actor.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately reflects a realistic threat: network-reachable, low complexity, requiring only a valid low-privileged account, with high confidentiality impact. There is no integrity or availability impact, anchoring this as a pure data-disclosure issue. EPSS data was not provided, limiting probabilistic exploitation forecasting. No KEV listing and no known POC code narrow the realistic threat actor pool to insiders, disgruntled employees, or attackers who have already compromised a low-privilege account. The 'Authentication Bypass' tag in the source data is somewhat misleading - authentication is still required (PR:L confirmed by CVSS), so this is more precisely an authorization bypass within an authenticated session, which limits opportunistic mass exploitation. Real-world risk is moderate-to-high for organizations with sensitive CRM pipelines, competitive intelligence, or regulated data in ERPNext opportunity records.

An authenticated ERPNext user with a low-privilege role - such as a sales representative who should only see their own assigned prospects - sends a crafted HTTP request to the get_opportunities API endpoint referencing prospect records outside their permitted scope. The missing authorization check returns full opportunity data for those records, exposing deal sizes, pipeline stages, contact details, and competitor intelligence to the unauthorized caller. No public exploit code has been identified, but the attack requires only a valid session token and knowledge of the endpoint path.