---
id: "CVE-2026-108374"
kind: "vulnerability"
aliases: ["CVE-2026-108374"]
title: "ERPNext: low-privilege users can change records beyond their role"
severity: "high"
cvss: 7.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "erpnext", "frappe", "package", "self-hosted"]
not_affected_if: ["managed-hosting", "single-user-instance"]
published_at: "2026-10-16T21:17:19+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:12:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108374", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# ERPNext: low-privilege users can change records beyond their role

ERPNext has status-change endpoints that skip authorization checks, so an authenticated low-privilege user can call them. That lets them modify documents they are not permitted to write, submit or cancel.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ERPNext version with `bench version` or the app's `version` in the bench apps list
- Versions below `15.121.0` on the 15.x line or below `16.34.0` on the 16.x line are affected

## Fix

- Upgrade ERPNext to `15.121.0` (15.x branch) or `16.34.0` (16.x branch)
- Run `bench migrate` after upgrading

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-108374

## From the sources

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks. This allows the user to modify data beyond the user's permitted role. This issue is fixed in versions 15.121.0 and 16.34.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_