{"id":"CVE-2026-124316","kind":"vulnerability","aliases":["CVE-2026-124316"],"related":[],"title":"Frappe ERPNext: logged-in users can read other companies' material requests","description":"Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.","summary":"ERPNext's get_linked_material_requests method does not check document or company permissions, so any authenticated user can pass item codes and retrieve open purchase material requests belonging to other companies. The attacker gets read access to other companies' purchasing data.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erp","erpnext","frappe","package","self-hosted"],"not_affected_if":["no-portal-users","patched-version"],"how_to_check":"- Check the installed ERPNext version with `bench version` or the erpnext app version in the Frappe site; versions below `15.121.4` on the 15.x line or below `16.36.0` on the 16.x line are affected.\n- Confirm whether portal or low-privilege users can log in to the site, since they are named as able to exploit this.","fix":"- ERPNext 15.x: move to `15.121.4` or later.\n- ERPNext 16.x: move to `16.36.0` or later.","status":"open","published_at":"2026-11-07T15:17:15+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","triaged_at":"2026-11-07T15:48:22+00:00","updated_at":"2026-11-07T15:48:22+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T15:48:22Z","model":"claude-haiku-5-5","output":{"fix":"- ERPNext 15.x: move to `15.121.4` or later.\n- ERPNext 16.x: move to `16.36.0` or later.","reach":"internet","title":"Frappe ERPNext: logged-in users can read other companies' material requests","impact":"low","summary":"ERPNext's get_linked_material_requests method does not check document or company permissions, so any authenticated user can pass item codes and retrieve open purchase material requests belonging to other companies. The attacker gets read access to other companies' purchasing data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["erpnext","frappe","self-hosted","erp"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users read other companies' open purchase material requests","analyst_note":"","how_to_check":"- Check the installed ERPNext version with `bench version` or the erpnext app version in the Frappe site; versions below `15.121.4` on the 15.x line or below `16.36.0` on the 16.x line are affected.\n- Confirm whether portal or low-privilege users can log in to the site, since they are named as able to exploit this.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-portal-users"],"who_is_affected":"Any ERPNext deployment before 15.121.4 or 16.x before 16.36.0 where users can log in, including customer or supplier portal users and users with no roles, can call the whitelisted method and read open Purchase-type Material Requests from other companies. Installations that are not reachable by logged-in users, or that run only a single company, have less exposure. unknown whether a specific deployment's portal configuration widens reach beyond what the sources state.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000747,"input_tokens":4329,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124316':15A,18A '-2026':14A,17A '15.121.4':71C '16':73C '16.36.0':76C 'access':62B 'attack':59B 'authent':42B,96C 'author':80C 'belong':54B,117C 'check':35B,95C 'code':47B,108C 'compani':10A,38B,57B,65B,93C,120C 'contain':77C 'cve':13A,16A 'data':67B 'document':36B,91C 'erp':19B 'erpnext':2A,20B,26B,69C 'erpnext.buying.utils.get':85C 'frapp':1A,21B,68C 'get':28B,60B 'host':25B 'includ':98C 'item':46B,107C 'lack':90C 'link':29B,86C 'log':4A 'logged-in':3A 'materi':11A,30B,52B,87C,115C 'method':32B,89C 'miss':79C 'open':50B,111C 'packag':22B 'pass':45B 'permiss':39B,94C 'portal':99C 'purchas':51B,66B,113C 'purchase-typ':112C 'read':8A,61B 'request':12A,31B,53B,88C,116C 'retriev':49B,110C 'role':104C 'self':24B 'self-host':23B 'suppli':106C 'type':114C 'user':6A,43B,97C,100C,102C 'vulner':81C 'whitelist':84C 'without':103C 'x':74C","nicknames":[],"mitigations":[],"who_affected":"Any ERPNext deployment before 15.121.4 or 16.x before 16.36.0 where users can log in, including customer or supplier portal users and users with no roles, can call the whitelisted method and read open Purchase-type Material Requests from other companies. Installations that are not reachable by logged-in users, or that run only a single company, have less exposure. unknown whether a specific deployment's portal configuration widens reach beyond what the sources state.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erp","erpnext","frappe","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124316':15A,18A '-2026':14A,17A 'compani':10A 'cve':13A,16A 'erpnext':2A 'frapp':1A 'log':4A 'logged-in':3A 'materi':11A 'read':8A 'request':12A 'user':6A","search_b":"'access':62B 'attack':59B 'authent':42B 'belong':54B 'check':35B 'code':47B 'compani':38B,57B,65B 'data':67B 'document':36B 'erp':19B 'erpnext':20B,26B 'frapp':21B 'get':28B,60B 'host':25B 'item':46B 'link':29B 'materi':30B,52B 'method':32B 'open':50B 'packag':22B 'pass':45B 'permiss':39B 'purchas':51B,66B 'read':61B 'request':31B,53B 'retriev':49B 'self':24B 'self-host':23B 'user':43B","search_c":"'15.121.4':71C '16':73C '16.36.0':76C 'authent':96C 'author':80C 'belong':117C 'check':95C 'code':108C 'compani':93C,120C 'contain':77C 'document':91C 'erpnext':69C 'erpnext.buying.utils.get':85C 'frapp':68C 'includ':98C 'item':107C 'lack':90C 'link':86C 'materi':87C,115C 'method':89C 'miss':79C 'open':111C 'permiss':94C 'portal':99C 'purchas':113C 'purchase-typ':112C 'request':88C,116C 'retriev':110C 'role':104C 'suppli':106C 'type':114C 'user':97C,100C,102C 'vulner':81C 'whitelist':84C 'without':103C 'x':74C","first_public_at":"2026-11-06T03:30:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124316","severity":null,"published_at":"2026-11-07T15:17:15+00:00","modified_at":"2026-11-07T15:17:16+00:00","first_seen_at":"2026-11-07T15:47:57+00:00","fetched_at":"2026-11-07T15:47:57+00:00","note":null}],"documents":[{"id":96368,"url":"https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96369,"url":"https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":96382,"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-w3rc-76j9-46jq","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-06T03:30:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":96383,"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-linked-material-requests","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}