CVE-2026-108374

7.7High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.7High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-862

Impact

Authenticated low-privileged users can modify ERPNext document statuses and alter records beyond their assigned permissions. Attackers only need basic login credentials to call exposed state-changing endpoints directly.

Root cause

Whitelisted state-modification endpoints omit authorization checks for write, submit, cancel, and role requirements.

Affected systems

ERPNext versions prior to 15.121.0 and prior to 16.34.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Fix & remediation

Upgrade ERPNext to version 15.121.0, 16.34.0, or newer. No workaround is provided, so restrict untrusted user access until the patch is deployed.

shell

$ bench update --apps erpnext

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108374