CVE-2026-109377: ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call getbatchqty, getbatchesbyoldest or getposreservedbatchqty to list every item batch with per-warehouse quantities.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user may be able to exploit it, including customer portal users. The exposed methods allow those users to enumerate item batches and associated quantities across warehouses.
What access or interaction is required for exploitation?
An attacker needs valid authenticated access to ERPNext and must be able to call the whitelisted batch lookup methods. No user interaction is required.
What information can be disclosed?
The affected methods can reveal every item batch and its per-warehouse stock quantities. The provided information describes a confidentiality impact only; it does not indicate modification or service-disruption capability.
How can I determine whether my deployment is affected?
Deployments running ERPNext versions from 9.0.0 through 16.50.0 are in scope. Review whether authenticated low-privilege or customer portal accounts can invoke get_batch_qty, get_batches_by_oldest, or get_pos_reserved_batch_qty and receive batch or warehouse quantity data.