EUVD-2026-97875
GHSA-jg45-xvf3-93rf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege portal user
-
ExploitCall whitelisted batch lookup method
-
ExecutionEnumerate batches and per-warehouse quantities
-
ImpactExfiltrate sensitive inventory data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated ERPNext session (PR:L); crucially, even a low-trust Customer/portal-role account suffices, as demonstrated by the vendor regression test where a 'Customer' portal user could call the endpoints. The attacker must reach the whitelisted methods get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty, which are network-accessible API endpoints. Limiting factors: exploitation is impossible for fully unauthenticated users, so instances that do not provision portal/customer accounts to untrusted parties face materially lower exposure; impact is limited to disclosure of batch and per-warehouse stock quantities with no write or availability effect. Affected versions 9.0.0 through 16.50.0; fixed by commit 10a2400 (PR #60147). |
| Impact | This is a moderate, confidentiality-only information-disclosure issue, not a high-priority emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) and the 5.3 base score are internally consistent with the description: exploitation is network-reachable and low-complexity but requires an authenticated session (PR:L), and the only impact is low confidentiality (VC:L) - no integrity or availability effect. The CWE-862 (Missing Authorization) classification and the fix (adding frappe.has_permission('Batch','select') checks) confirm this is a broken-access-control/authorization gap, not remote code execution. No EPSS score, no CISA KEV listing, and no public POC were supplied, so by the precision rules this is 'no public exploit identified at time of analysis.' The notable amplifier is that low-trust customer portal users - not just internal staff - can call the affected methods, so the practical privilege barrier is very low even though PR:L technically holds. Net: a legitimate but low-urgency patch item; prioritize it where ERPNext exposes a customer/portal front-end to untrusted users, but it does not warrant the same escalation as a KEV-listed or code-execution flaw. |
| Exploit ScenarioDerived | A low-privilege customer portal user (or any authenticated account) logs into an ERPNext instance and invokes the whitelisted methods get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty. Because these endpoints lacked a Batch permission check, the attacker enumerates every item batch and its per-warehouse stock quantities, harvesting competitively sensitive inventory data they were never authorized to see. No public exploit code was identified, but the attack is a trivial authenticated API call requiring no special tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Missing authorization checks in ERPNext's whitelisted batch lookup methods let any authenticated user - including a low-privilege Customer portal account - enumerate every item batch together with its per-warehouse stock quantities, exposing inventory levels that should require Batch read access. The flaw spans versions 9.0.0 through 16.50.0 and is reachable over the network through the Frappe API (CVSS 4.0 base 5.3; independent assessment CVSS 3.1 5.3, AV:N/AC:L/PR:L/UI:N, confidentiality-only). There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this is a moderate information-disclosure issue rather than an emergency; an upstream fix commit has been published.
RemediationAI
Apply the upstream fix in commit 10a2400312afd17df740c6ed64e0803dfbabb623, delivered via pull request https://github.com/frappe/erpnext/pull/60147, which adds frappe.has_permission("Batch", "select", throw=True) before the batch quantity responses; note this is a commit/PR-level fix and no tagged release containing it was independently confirmed, so verify your ERPNext build includes the change or upgrade to the first release that does (version 16.50.0 is still vulnerable per the advisory range). Until the patch is deployed, reduce exposure by not granting the Customer/portal role to untrusted external users, since the regression test shows that role is sufficient to reach all three endpoints, and by restricting which roles can access batches at the site level - the trade-off is that legitimate portal ordering or stock-visibility workflows may break. As a compensating control, block or rate-limit requests to the get_batch_qty, get_batches_by_oldest, and get_pos_reserved_batch_qty methods at the reverse proxy or API gateway; this stops bulk enumeration but requires maintaining an explicit deny list as ERPNext adds endpoints, and can break point-of-sale batch reservation logic if applied too broadly. Detection-wise, audit server access logs for authenticated Customer-role sessions invoking these methods and treat successful calls as reconnaissance of warehouse stock levels.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ERPNext is built on the Frappe framework, where Python functions decorated as "whitelisted" become network-callable RPC/REST endpoints. The affected code lives in erpnext/stock/doctype/batch/batch.py, specifically the batch quantity helpers get_batch_qty, get_batches_by_oldest, and get_pos_reserved_batch_qty (referenced lines 235-301), plus the make_batch path touched by the same fix. These methods returned batch and per-warehouse quantity data without first calling frappe.has_permission("Batch", "select"), the framework's standard document-level permission gate - the root cause class CWE-862 (Missing Authorization). The vendor's fix commit 10a2400312afd17df740c6ed64e0803dfbabb623 (PR #60147) inserts frappe.has_permission("Batch", "select", throw=True) at three call sites and adds a regression test, test_batch_stock_endpoints_need_batch_access, which asserts that a user created with the "Customer" role raises frappe.PermissionError on all three endpoints while a "Sales User" still succeeds. That test is direct evidence that the privilege boundary being crossed is role-based document permission rather than authentication itself: the endpoints were never unauthenticated, they simply failed to enforce Batch-level read permission.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-accessible whitelisted API with low complexity and no user interaction, but needs any authenticated account (PR:L); only low confidentiality impact (inventory data) with no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB