{"id":"CVE-2026-124313","kind":"vulnerability","aliases":["CVE-2026-124313"],"related":[],"title":"ERPNext: any logged-in user can read other companies' payment allocation data","description":"Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.","summary":"ERPNext's whitelisted get_linked_payments_for_doc method does not check authorization, so any authenticated user, including portal users, can pass arbitrary company, doctype and docname values. An attacker can read Payment Ledger Entry allocation data for other companies' invoices and vouchers.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","erpnext","frappe","package","self-hosted"],"not_affected_if":["no-external-logins","patched-version"],"how_to_check":"- Check the installed ERPNext version with `bench version` or the erpnext app's version in the site's apps list, and compare it to the fixed versions below.\n- Look for portal or customer accounts on the site that should not see other companies' financial records.","fix":"- ERPNext `15.x` before `15.121.4`: move to `15.121.4` or later.\n- ERPNext `16.x` before `16.36.0`: move to `16.36.0` or later.","status":"open","published_at":"2026-11-07T15:17:15+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:22+00:00","updated_at":"2026-11-07T15:48:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T15:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- ERPNext `15.x` before `15.121.4`: move to `15.121.4` or later.\n- ERPNext `16.x` before `16.36.0`: move to `16.36.0` or later.","reach":"internet","title":"ERPNext: any logged-in user can read other companies' payment allocation data","impact":"medium","summary":"ERPNext's whitelisted get_linked_payments_for_doc method does not check authorization, so any authenticated user, including portal users, can pass arbitrary company, doctype and docname values. An attacker can read Payment Ledger Entry allocation data for other companies' invoices and vouchers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["erpnext","frappe","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads other companies' payment allocation records and invoice data","analyst_note":"","how_to_check":"- Check the installed ERPNext version with `bench version` or the erpnext app's version in the site's apps list, and compare it to the fixed versions below.\n- Look for portal or customer accounts on the site that should not see other companies' financial records.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-external-logins"],"who_is_affected":"Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 where users can log in, including customer or supplier portal users. Exposure depends on whether authenticated users can reach the whitelisted method, which portal users can. Single-company sites with no external logins have less exposure to other companies' data.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000734,"input_tokens":4324,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124313':16A,19A '-2026':15A,18A '15.121.4':73C '16':75C '16.36.0':78C 'alloc':12A,62B,112C 'arbitrari':49B,101C 'attack':56B 'authent':42B,94C 'author':39B,82C 'check':38B 'compani':10A,50B,66B,102C,116C 'contain':79C 'cve':14A,17A 'data':13A,63B,113C 'doc':34B,91C 'docnam':53B,105C 'doctyp':51B,103C 'entri':61B,111C 'erp':20B 'erpnext':1A,21B,27B,71C 'frapp':22B,70C 'get':30B,87C 'host':26B 'includ':44B,96C 'invoic':67B,117C 'ledger':60B,110C 'link':31B,88C 'log':4A 'logged-in':3A 'method':35B,92C 'miss':81C 'packag':23B 'pass':48B 'payment':11A,32B,59B,89C,109C 'portal':45B,97C 'read':8A,58B,108C 'self':25B 'self-host':24B 'suppli':100C 'user':6A,43B,46B,95C,98C 'valu':54B,106C 'voucher':69B,119C 'vulner':83C 'whitelist':29B,86C 'x':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 where users can log in, including customer or supplier portal users. Exposure depends on whether authenticated users can reach the whitelisted method, which portal users can. Single-company sites with no external logins have less exposure to other companies' data.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erp","erpnext","frappe","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124313':16A,19A '-2026':15A,18A 'alloc':12A 'compani':10A 'cve':14A,17A 'data':13A 'erpnext':1A 'log':4A 'logged-in':3A 'payment':11A 'read':8A 'user':6A","search_b":"'alloc':62B 'arbitrari':49B 'attack':56B 'authent':42B 'author':39B 'check':38B 'compani':50B,66B 'data':63B 'doc':34B 'docnam':53B 'doctyp':51B 'entri':61B 'erp':20B 'erpnext':21B,27B 'frapp':22B 'get':30B 'host':26B 'includ':44B 'invoic':67B 'ledger':60B 'link':31B 'method':35B 'packag':23B 'pass':48B 'payment':32B,59B 'portal':45B 'read':58B 'self':25B 'self-host':24B 'user':43B,46B 'valu':54B 'voucher':69B 'whitelist':29B","search_c":"'15.121.4':73C '16':75C '16.36.0':78C 'alloc':112C 'arbitrari':101C 'authent':94C 'author':82C 'compani':102C,116C 'contain':79C 'data':113C 'doc':91C 'docnam':105C 'doctyp':103C 'entri':111C 'erpnext':71C 'frapp':70C 'get':87C 'includ':96C 'invoic':117C 'ledger':110C 'link':88C 'method':92C 'miss':81C 'payment':89C,109C 'portal':97C 'read':108C 'suppli':100C 'user':95C,98C 'valu':106C 'voucher':119C 'vulner':83C 'whitelist':86C 'x':76C","first_public_at":"2026-11-06T03:43:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124313","severity":null,"published_at":"2026-11-07T15:17:15+00:00","modified_at":"2026-11-07T15:17:15+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96368,"url":"https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96369,"url":"https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96370,"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-hf2q-xhq6-q394","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T03:43:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":96371,"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-linked-payments-for-doc","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}