CVE-2026-124316: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Published Nov 7, 2026

Updated

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.getlinkedmaterialrequests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.

Event History

Nov 7, 2026

CVE Published

via MITRE·02:17 PM

Data Sourced

via MITRE·02:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated ERPNext user can exploit it, including portal users and users without assigned roles. The issue does not require access to the target company.

What information can an attacker retrieve?

An attacker can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies. The exposed method lacks document-level and company-level permission checks.

Which deployments are affected?

ERPNext releases before 15.121.4 are affected, as are 16.x releases before 16.36.0.

How can I determine whether this vulnerability may already have been exploited?

Review requests to the whitelisted erpnext.buying.utils.get_linked_material_requests method, particularly calls made by portal users or users without roles and requests for item codes associated with other companies. The provided information does not identify specific logging fields or indicators beyond use of this method.

CVE-2026-124316: Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests

Event History

Frequently Asked Questions

Which users can exploit this issue?

What information can an attacker retrieve?

Which deployments are affected?

How can I determine whether this vulnerability may already have been exploited?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What information can an attacker retrieve?

Which deployments are affected?

How can I determine whether this vulnerability may already have been exploited?