---
id: "CVE-2026-124313"
page: "https://infrastack.ai/live/CVE-2026-124313"
kind: "vulnerability"
aliases: ["CVE-2026-124313"]
title: "ERPNext: any logged-in user can read other companies' payment allocation data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "erpnext", "frappe", "package", "self-hosted"]
not_affected_if: ["no-external-logins", "patched-version"]
published_at: "2026-11-07T15:17:15+00:00"
first_seen_at: "2026-11-07T15:47:57+00:00"
updated_at: "2026-11-07T15:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124313", "first_seen_at": "2026-11-07T15:47:57+00:00"}]
exploit_sources: []
---

# ERPNext: any logged-in user can read other companies' payment allocation data

Link for people: https://infrastack.ai/live/CVE-2026-124313 (this .md is for agents)

ERPNext's whitelisted get_linked_payments_for_doc method does not check authorization, so any authenticated user, including portal users, can pass arbitrary company, doctype and docname values. An attacker can read Payment Ledger Entry allocation data for other companies' invoices and vouchers.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ERPNext version with `bench version` or the erpnext app's version in the site's apps list, and compare it to the fixed versions below.
- Look for portal or customer accounts on the site that should not see other companies' financial records.

## Fix

- ERPNext `15.x` before `15.121.4`: move to `15.121.4` or later.
- ERPNext `16.x` before `16.36.0`: move to `16.36.0` or later.

## Timeline

- 2026-11-07T15:47:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124313

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/erpnext/security/advisories/GHSA-hf2q-xhq6-q394
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-linked-payments-for-doc
- [fix] Patch: github.com https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3
- [fix] Patch: github.com https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364

## From the sources

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_