CVE-2026-124315 · Runtime
NO FIX YET · SEE WHAT TO DO
ERPNext's whitelisted get_bom_items and get_bom_diff methods skip the read permission check on Bills of Materials. Any authenticated user, including portal or no-role users, can read every raw material, quantity, rate and cost of a BOM.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 are exposed. Any user with a login, including portal users with no roles, can read BOM cost data, so sites without external logins carry less risk. Sites that have already upgraded or do not run ERPNext can skip it.
Not affected if no-portal-users, patched-version
Who cares erpnext, frappe, manufacturing, self-hosted
bench version and compare it to the fixed ranges.15.121.416.36.0Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call get_bom_items with a BOM name to retrieve every raw material, quantity, rate and cost.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.