CVE-2026-124316mediumCWE-862

CVE-2026-124316: falha de média gravidade em frappe erpnext

Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Publicada em

Seguir esta CVE+ Monitorar erpnext

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

10Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
frappe · erpnext
CVEs relacionadas — frappe erpnext

No mesmo produto, das mais perigosas para as menos.

CVE-2026-65974CRITICALERPNext: Server-Side Template Injection leading to Remote Code ExecutionEPSS 1.0%CVE-2026-72911CRITICALERPNext: Possibility of server-side template injection due to missing validationEPSS 0.7%CVE-2026-72908MEDIUMERPNext: Possibility of SQL injection due to missing validationEPSS 0.5%CVE-2026-72910HIGHERPNext: Unauthorised modification of master data due to missing validationEPSS 0.5%CVE-2026-72909HIGHERPNext: Broken Access Control on certain endpointsEPSS 0.5%CVE-2026-65822HIGHERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filterEPSS 0.5%