CVE-2026-124313 · Package
NO FIX YET · SEE WHAT TO DO
ERPNext's whitelisted get_linked_payments_for_doc method does not check authorization, so any authenticated user, including portal users, can pass arbitrary company, doctype and docname values. An attacker can read Payment Ledger Entry allocation data for other companies' invoices and vouchers.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 where users can log in, including customer or supplier portal users. Exposure depends on whether authenticated users can reach the whitelisted method, which portal users can. Single-company sites with no external logins have less exposure to other companies' data.
Not affected if no-external-logins, patched-version
Who cares erp, erpnext, frappe, self-hosted
bench version or the erpnext app's version in the site's apps list, and compare it to the fixed versions below.15.x before 15.121.4: move to 15.121.4 or later.16.x before 16.36.0: move to or later.Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
16.36.0This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.