CVE-2026-124316 · Package
NO FIX YET · SEE WHAT TO DO
ERPNext's get_linked_material_requests method does not check document or company permissions, so any authenticated user can pass item codes and retrieve open purchase material requests belonging to other companies. The attacker gets read access to other companies' purchasing data.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any ERPNext deployment before 15.121.4 or 16.x before 16.36.0 where users can log in, including customer or supplier portal users and users with no roles, can call the whitelisted method and read open Purchase-type Material Requests from other companies. Installations that are not reachable by logged-in users, or that run only a single company, have less exposure. unknown whether a specific deployment's portal configuration widens reach beyond what the sources state.
Not affected if no-portal-users, patched-version
Who cares erp, erpnext, frappe, self-hosted
bench version or the erpnext app version in the Frappe site; versions below 15.121.4 on the 15.x line or below 16.36.0 on the 16.x line are affected.15.121.4 or later.16.36.0 or later.Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.