CVE-2026-124315: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

Published Nov 7, 2026

Updated

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted getbomitems and getbomdiff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call getbomitems with a BOM name to retrieve every raw material, quantity, rate and cost.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated ERPNext user can exploit it, including portal users and users with no assigned role. The affected methods do not enforce BOM read permissions.

What information can an attacker obtain?

A caller who knows a BOM name can retrieve its raw materials, quantities, rates, and costs through get_bom_items. The description also identifies get_bom_diff as lacking BOM read permission checks.

What access or input does exploitation require?

The attacker must be authenticated and must call the whitelisted method with a BOM name. No BOM read permission is required.

Which releases are affected?

ERPNext releases before 15.121.4 are affected, as are 16.x releases before 16.36.0.

CVE-2026-124315: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information can an attacker obtain?

What access or input does exploitation require?

Which releases are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information can an attacker obtain?

What access or input does exploitation require?

Which releases are affected?