Live › vulnerability › CVE-2026-108374
Go to dashboardERPNext has status-change endpoints that skip authorization checks, so an authenticated low-privilege user can call them. That lets them modify documents they are not permitted to write, submit or cancel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any self-hosted ERPNext instance on a version before 15.121.0 or 16.34.0 with more than one user account is exposed, since the attacker needs a logged-in low-privilege account. Instances where every user has full write rights gain little from this flaw. Hosted ERPNext providers should be confirmed by their vendor.
No product ranges from the sources yet.
bench version or the app's version in the bench apps list15.121.0 on the 15.x line or below 16.34.0 on the 16.x line are affected15.121.0 (15.x branch) or 16.34.0 (16.x branch)bench migrate after upgradingEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-108374")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.