Frappe ERPNext EUVD-2026-98046

Exploitation requires a valid authenticated ERPNext account with low privileges (PR:L) - it cannot be performed by an anonymous/unauthenticated attacker. The specific prerequisite is access to the affected inventory endpoints that omit role-based authorization checks in ERPNext versions before 15.115.0 (15.x) or before 16.26.0 (16.x). Limiting factors: the attacker must already hold credentials on the target instance, and impact is restricted to integrity of inventory records (no data disclosure or service disruption per the VC:N/VA:N rating). Instances upgraded to 15.115.0/16.26.0 or later are not affected.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) describes a network-reachable, low-complexity flaw requiring low-privilege authentication (PR:L) with no user interaction, scoring 7.1 (High) with impact confined entirely to integrity - confidentiality and availability are rated N. This is consistent with the CWE-862 Missing Authorization classification: the risk is that an authenticated low-privileged user can tamper with inventory data they should not be able to modify, not data theft or outage. On real-world signals, there is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input, so exploitation is not confirmed in the wild and automatability is unknown. The practical risk is therefore moderate and insider/abuse-of-access oriented rather than a mass-exploitation emergency: an attacker must already possess valid, if limited, ERPNext credentials. Note a labeling tension - the input Tags call this 'Authentication Bypass,' but the CWE-862 classification and description describe an authorization (access-control) failure by an already-authenticated user, not an authentication bypass; treat the authorization framing as authoritative. No EPSS/KEV/POC data was supplied, so exploitation likelihood is inferred only from the low barrier (authenticated low-priv, network, low complexity), not from observed activity.

A low-privileged ERPNext user (e.g. a sales or support account) with valid credentials sends crafted requests directly to inventory-related endpoints that fail to re-check role-based permissions. Because the endpoints trust the request without enforcing authorization, the user alters stock levels, item records, or warehouse quantities beyond their assigned role. No public exploit code was identified at time of analysis, but the attack is low-complexity and requires no user interaction or elevated privileges.