{"id":"CVE-2026-108374","kind":"vulnerability","aliases":["CVE-2026-108374"],"related":[],"title":"ERPNext: low-privilege users can change records beyond their role","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.","summary":"ERPNext has status-change endpoints that skip authorization checks, so an authenticated low-privilege user can call them. That lets them modify documents they are not permitted to write, submit or cancel.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","erpnext","frappe","package","self-hosted"],"not_affected_if":["managed-hosting","single-user-instance"],"how_to_check":"- Check the installed ERPNext version with `bench version` or the app's `version` in the bench apps list\n- Versions below `15.121.0` on the 15.x line or below `16.34.0` on the 16.x line are affected","fix":"- Upgrade ERPNext to `15.121.0` (15.x branch) or `16.34.0` (16.x branch)\n- Run `bench migrate` after upgrading","status":"open","published_at":"2026-10-16T21:17:19+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:12:06+00:00","updated_at":"2026-10-25T03:12:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:12:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ERPNext to `15.121.0` (15.x branch) or `16.34.0` (16.x branch)\n- Run `bench migrate` after upgrading","reach":"network","title":"ERPNext: low-privilege users can change records beyond their role","impact":"medium","summary":"ERPNext has status-change endpoints that skip authorization checks, so an authenticated low-privilege user can call them. That lets them modify documents they are not permitted to write, submit or cancel.","category":"package","nicknames":[],"who_cares":["erpnext","frappe","self-hosted","erp"],"confidence":0.7,"needs_auth":"yes","worst_case":"low-privilege user modifies documents beyond their role","analyst_note":"","how_to_check":"- Check the installed ERPNext version with `bench version` or the app's `version` in the bench apps list\n- Versions below `15.121.0` on the 15.x line or below `16.34.0` on the 16.x line are affected","needs_analyst":false,"not_affected_if":["single-user-instance","managed-hosting"],"who_is_affected":"Any self-hosted ERPNext instance on a version before 15.121.0 or 16.34.0 with more than one user account is exposed, since the attacker needs a logged-in low-privilege account. Instances where every user has full write rights gain little from this flaw. Hosted ERPNext providers should be confirmed by their vendor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000598,"input_tokens":3360,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108374':14A,17A '-2026':13A,16A '15.121.0':72C,127C '16.34.0':74C,129C 'allow':109C 'authent':37B,90C 'author':33B,84C 'beyond':9A,115C 'call':43B 'cancel':58B,103C 'certain':75C 'chang':7A,29B,96C 'check':34B,85C,107C 'cve':12A,15A 'data':114C 'document':49B,104C 'endpoint':30B,76C 'enforc':82C 'enterpris':66C 'erp':18B 'erpnext':1A,19B,25B,59C 'fail':80C 'fix':124C 'frapp':20B 'free':62C 'host':24B 'invok':93C 'issu':122C 'let':46B 'low':3A,39B,88C 'low-privileg':2A,38B,87C 'method':98C 'modif':79C 'modifi':48B,113C 'open':64C 'packag':21B 'permit':53B,119C 'plan':68C 'prior':70C 'privileg':4A,40B,89C 'proper':83C 'record':8A 'requir':100C 'resourc':67C 'role':11A,106C,120C 'self':23B 'self-host':22B 'skip':32B 'sourc':65C 'state':95C 'state-chang':94C 'status':28B,78C 'status-chang':27B 'submit':56B,102C 'tool':69C 'user':5A,41B,91C,111C,117C 'version':126C 'whitelist':97C 'without':99C 'write':55B,101C","nicknames":[],"mitigations":[],"who_affected":"Any self-hosted ERPNext instance on a version before 15.121.0 or 16.34.0 with more than one user account is exposed, since the attacker needs a logged-in low-privilege account. Instances where every user has full write rights gain little from this flaw. Hosted ERPNext providers should be confirmed by their vendor.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T21:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108374","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108374","severity":null,"published_at":"2026-10-16T21:17:19+00:00","modified_at":"2026-10-19T15:16:54+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}