CVE-2026-109377: ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods

Q: Which users can exploit this issue?

Any authenticated user may be able to exploit it, including customer portal users. The exposed methods allow those users to enumerate item batches and associated quantities across warehouses.

Q: What access or interaction is required for exploitation?

An attacker needs valid authenticated access to ERPNext and must be able to call the whitelisted batch lookup methods. No user interaction is required.

Q: What information can be disclosed?

The affected methods can reveal every item batch and its per-warehouse stock quantities. The provided information describes a confidentiality impact only; it does not indicate modification or service-disruption capability.

Q: How can I determine whether my deployment is affected?

Deployments running ERPNext versions from 9.0.0 through 16.50.0 are in scope. Review whether authenticated low-privilege or customer portal accounts can invoke get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty and receive batch or warehouse quantity data.

Published Oct 12, 2026

Updated

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item batch with per-warehouse quantities.

Affected Software

1 affected component

ERPNext ERPNext>=9.0.0<=16.50.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated user may be able to exploit it, including customer portal users. The exposed methods allow those users to enumerate item batches and associated quantities across warehouses.

What access or interaction is required for exploitation?

An attacker needs valid authenticated access to ERPNext and must be able to call the whitelisted batch lookup methods. No user interaction is required.

What information can be disclosed?

The affected methods can reveal every item batch and its per-warehouse stock quantities. The provided information describes a confidentiality impact only; it does not indicate modification or service-disruption capability.

How can I determine whether my deployment is affected?

Deployments running ERPNext versions from 9.0.0 through 16.50.0 are in scope. Review whether authenticated low-privilege or customer portal accounts can invoke get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty and receive batch or warehouse quantity data.

CVE-2026-109377: ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

What access or interaction is required for exploitation?

What information can be disclosed?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What access or interaction is required for exploitation?

What information can be disclosed?

How can I determine whether my deployment is affected?