CVE-2026-108373: ERPNext: Unauthorised access to financial data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.118.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.27.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ERPNext user with a role limited by document permissions can exploit the affected Sales Person-wise Transaction Summary report endpoints. No user interaction is required.
What data could be exposed?
Affected requests can return financial transaction rows without applying the requesting user's document-permission match conditions, allowing access to financial data outside that user's permitted role.
Which ERPNext versions are affected and what fixes the issue?
ERPNext versions before 15.118.0 and before 16.27.0 are affected. Upgrade to 15.118.0 or 16.27.0, as applicable.