{"id":"CVE-2026-124315","kind":"vulnerability","aliases":["CVE-2026-124315"],"related":[],"title":"ERPNext: missing permission checks let any logged-in user read BOM costs","description":"Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call get_bom_items with a BOM name to retrieve every raw material, quantity, rate and cost.","summary":"ERPNext's whitelisted get_bom_items and get_bom_diff methods skip the read permission check on Bills of Materials. Any authenticated user, including portal or no-role users, can read every raw material, quantity, rate and cost of a BOM.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","manufacturing","runtime","self-hosted"],"not_affected_if":["no-portal-users","patched-version"],"how_to_check":"- Check the installed ERPNext version with `bench version` and compare it to the fixed ranges.\n- Review who holds accounts on the site, especially portal or no-role users.","fix":"- ERPNext before 15.121.4: move to `15.121.4`\n- ERPNext 16.x before 16.36.0: move to `16.36.0`","status":"open","published_at":"2026-11-07T15:17:15+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:09+00:00","updated_at":"2026-11-07T15:48:09+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-07T15:48:09Z","model":"claude-haiku-5-5","output":{"fix":"- ERPNext before 15.121.4: move to `15.121.4`\n- ERPNext 16.x before 16.36.0: move to `16.36.0`","reach":"network","title":"ERPNext: missing permission checks let any logged-in user read BOM costs","impact":"medium","summary":"ERPNext's whitelisted get_bom_items and get_bom_diff methods skip the read permission check on Bills of Materials. Any authenticated user, including portal or no-role users, can read every raw material, quantity, rate and cost of a BOM.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["erpnext","frappe","self-hosted","manufacturing"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated users read BOM costs and raw material data","analyst_note":"","how_to_check":"- Check the installed ERPNext version with `bench version` and compare it to the fixed ranges.\n- Review who holds accounts on the site, especially portal or no-role users.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-portal-users"],"who_is_affected":"Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 are exposed. Any user with a login, including portal users with no roles, can read BOM cost data, so sites without external logins carry less risk. Sites that have already upgraded or do not run ERPNext can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000717,"input_tokens":4327,"output_tokens":568,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124315':16A,19A '-2026':15A,18A '15.121.4':72C '16':74C '16.36.0':77C 'authent':48B,101C 'author':81C 'bill':44B 'bom':12A,31B,35B,68B,87C,91C,96C,113C,117C 'call':111C 'check':4A,42B,99C 'contain':78C 'cost':13A,65B,127C 'cve':14A,17A 'diff':36B,92C 'erpnext':1A,20B,27B,70C 'everi':59B,121C 'frapp':21B,69C 'get':30B,34B,86C,90C,112C 'host':26B 'includ':50B,103C 'item':32B,88C,114C 'let':5A 'log':8A 'logged-in':7A 'manufactur':22B 'materi':46B,61B,123C 'method':37B,93C 'miss':2A,80C 'name':118C 'no-rol':53B,106C 'permiss':3A,41B,98C 'portal':51B,104C 'quantiti':62B,124C 'rate':63B,125C 'raw':60B,122C 'read':11A,40B,58B,97C 'retriev':120C 'role':55B,108C 'runtim':23B 'self':25B 'self-host':24B 'skip':38B,95C 'user':10A,49B,56B,102C,109C 'vulner':82C 'whitelist':29B,85C 'x':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running ERPNext 15 before 15.121.4 or ERPNext 16 before 16.36.0 are exposed. Any user with a login, including portal users with no roles, can read BOM cost data, so sites without external logins carry less risk. Sites that have already upgraded or do not run ERPNext can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappe","high","manufacturing","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124315':16A,19A '-2026':15A,18A 'bom':12A 'check':4A 'cost':13A 'cve':14A,17A 'erpnext':1A 'let':5A 'log':8A 'logged-in':7A 'miss':2A 'permiss':3A 'read':11A 'user':10A","search_b":"'authent':48B 'bill':44B 'bom':31B,35B,68B 'check':42B 'cost':65B 'diff':36B 'erpnext':20B,27B 'everi':59B 'frapp':21B 'get':30B,34B 'host':26B 'includ':50B 'item':32B 'manufactur':22B 'materi':46B,61B 'method':37B 'no-rol':53B 'permiss':41B 'portal':51B 'quantiti':62B 'rate':63B 'raw':60B 'read':40B,58B 'role':55B 'runtim':23B 'self':25B 'self-host':24B 'skip':38B 'user':49B,56B 'whitelist':29B","search_c":"'15.121.4':72C '16':74C '16.36.0':77C 'authent':101C 'author':81C 'bom':87C,91C,96C,113C,117C 'call':111C 'check':99C 'contain':78C 'cost':127C 'diff':92C 'erpnext':70C 'everi':121C 'frapp':69C 'get':86C,90C,112C 'includ':103C 'item':88C,114C 'materi':123C 'method':93C 'miss':80C 'name':118C 'no-rol':106C 'permiss':98C 'portal':104C 'quantiti':124C 'rate':125C 'raw':122C 'read':97C 'retriev':120C 'role':108C 'skip':95C 'user':102C,109C 'vulner':82C 'whitelist':85C 'x':75C","first_public_at":"2026-11-06T03:43:46+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124315","severity":null,"published_at":"2026-11-07T15:17:15+00:00","modified_at":"2026-11-07T15:17:15+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96368,"url":"https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96369,"url":"https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96378,"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-w587-ghqf-6jpp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T03:43:46+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":96379,"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-bom-items","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}