Frappe

CVE-2026-124316: Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_materia

CVE-2026-124316 Nov 7, 2026 Source: Vendor

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-124316

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines

Showing 1–2 of 2

CVE-2026-124316 BR2026-0000-043344 unclaimed

Credited as Joost Grunwald (Edufort)

CVE-2026-124316 BR2026-0000-043345 unclaimed

Credited as Shohruh Yo'ldoshov