CVE-2026-108374: ERPNext: Unauthorised status modification due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.121.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.34.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with low privileges can exploit it. The attacker does not need user interaction and can invoke affected whitelisted state-changing methods over the network.
Which deployments are affected?
ERPNext versions earlier than 15.121.0 and 16.34.0 are affected. The issue involves endpoints that do not enforce required write, submit, cancel, document, or role checks.
What is the impact of successful exploitation?
A low-privileged user can modify data beyond what their assigned role permits by changing document status through affected endpoints.
How can the issue be remediated?
Upgrade ERPNext to version 15.121.0 or 16.34.0, which include the authorization-check fixes.