EUVD-2026-55832Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Network-reachable HTTP API requiring only a valid low-privilege session; no confidentiality impact; high integrity impact from unrestricted financial record writes; low availability disruption from record corruption.
Primary rating from Vendor (github).
CVSS VectorVendor: github
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
AnalysisAI
Broken access control in ERPNext's accounts module permits authenticated low-privilege users to invoke privileged write operations across five functions - merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center - without any server-side permission enforcement. All v15 releases prior to 15.112.0 and all v16 releases prior to 16.22.0 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active, authenticated ERPNext session with any valid user role - including the lowest-privilege roles such as Accounts User (CVSS PR:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, score 7.1) is well-calibrated: network exploitability with low complexity and only a valid low-privilege session required is consistent with the Frappe whitelist API model, and the high integrity / low availability / no confidentiality breakdown accurately reflects unrestricted financial record manipulation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated ERPNext user holding only a basic Accounts User role constructs a direct HTTP POST request to the update_cost_center or merge_account whitelisted API endpoint, supplying a target document name obtained from the ERPNext UI. Because the server-side function performs no write-permission check before executing, the request succeeds and the attacker reassigns cost centers or merges chart-of-accounts entries outside their authorized scope, corrupting financial records without triggering any role-based access control alert. … |
| Remediation | Upgrade ERPNext to version 15.112.0 (v15 branch) or 16.22.0 (v16 branch), both of which contain the complete authorization fixes confirmed by commits 2ae6451f10926bd12b6ce6c7dc40f08da83f2460, 8c7a313a38dfe38c9e35ca41e91389bcfaed2404, and ba936eefabb784805daa4c602b4baec9fc243ff8 as referenced at the GitHub Security Advisory GHSA-qpvh-75wh-j645. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all ERPNext instances and confirm affected versions (v15 < 15.112.0 or v16 < 16.22.0); determine active low-privilege user count and current session exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today