---
id: "CVE-2026-124316"
page: "https://infrastack.ai/live/CVE-2026-124316"
kind: "vulnerability"
aliases: ["CVE-2026-124316"]
title: "Frappe ERPNext: logged-in users can read other companies' material requests"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erp", "erpnext", "frappe", "package", "self-hosted"]
not_affected_if: ["no-portal-users", "patched-version"]
published_at: "2026-11-07T15:17:15+00:00"
first_seen_at: "2026-11-07T15:47:57+00:00"
updated_at: "2026-11-07T15:48:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124316", "first_seen_at": "2026-11-07T15:47:57+00:00"}]
exploit_sources: []
---

# Frappe ERPNext: logged-in users can read other companies' material requests

Link for people: https://infrastack.ai/live/CVE-2026-124316 (this .md is for agents)

ERPNext's get_linked_material_requests method does not check document or company permissions, so any authenticated user can pass item codes and retrieve open purchase material requests belonging to other companies. The attacker gets read access to other companies' purchasing data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ERPNext version with `bench version` or the erpnext app version in the Frappe site; versions below `15.121.4` on the 15.x line or below `16.36.0` on the 16.x line are affected.
- Confirm whether portal or low-privilege users can log in to the site, since they are named as able to exploit this.

## Fix

- ERPNext 15.x: move to `15.121.4` or later.
- ERPNext 16.x: move to `16.36.0` or later.

## Timeline

- 2026-11-07T15:47:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124316

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/erpnext/security/advisories/GHSA-w3rc-76j9-46jq
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-linked-material-requests
- [fix] Patch: github.com https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3
- [fix] Patch: github.com https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364

## From the sources

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_