CVE-2026-13227: ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.getopportunities.
This issue affects ERPNext: before 15.115.0, before 16.26.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.26.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.115.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13227?
CVE-2026-13227 has a high severity rating of 7.1 according to the CVSS score.
How do I fix CVE-2026-13227?
To fix CVE-2026-13227, upgrade ERPNext to version 16.26.0 or later, or 15.115.0 or later.
What versions of ERPNext are affected by CVE-2026-13227?
CVE-2026-13227 affects ERPNext versions prior to 15.115.0 and 16.26.0.
What type of vulnerability is CVE-2026-13227?
CVE-2026-13227 is classified as an improper authorization vulnerability in the Prospect opportunities API.
What impact does CVE-2026-13227 have on users?
CVE-2026-13227 allows unauthorized access to sensitive opportunity data in ERPNext, posing a significant risk to user data.