CVE-2026-108373 in ERPNext
Summary
by MITRE • 10/17/2026
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/17/2026
ERPNext serves as a prominent free and open-source Enterprise Resource Planning solution, widely adopted for managing complex business operations including sales, inventory, accounting, and human resources. Within such systems, the integrity of financial data is paramount, relying heavily on robust access control mechanisms to ensure that users can only interact with information relevant to their specific roles and responsibilities. The vulnerability identified in versions prior to 15.118.0 for version 15.x branches and prior to 16.27.0 for version 16.x branches centers on a critical failure within the Sales Person-wise Transaction Summary report module. This component is designed to aggregate and display financial transaction data based on sales personnel performance, but it contains a logic flaw that bypasses standard document permission checks during query execution.
The technical root cause of this vulnerability lies in how the backend handles database queries for specific reports. When an authenticated user with role-based restrictions requests data from the Sales Person-wise Transaction Summary report, the application fails to apply the requesting user's document permission match conditions to the underlying SQL query. In a properly secured ERP system, every read operation must be filtered by the permissions associated with the active session or user profile. However, in this flawed implementation, the query retrieves financial transaction rows without verifying whether the current user has authorization to view those specific records. This omission effectively neutralizes the role-based access control layer for this particular endpoint, allowing any authenticated user to bypass restrictions intended to limit data visibility based on their assigned permissions.
The operational impact of this flaw is significant from a security and compliance perspective. It enables an attacker with low-privileged or restricted roles to perform unauthorized information disclosure by accessing sensitive financial transaction details that should remain hidden. This includes potentially viewing revenue figures, customer payment histories, pricing structures, and other confidential business metrics belonging to colleagues or departments outside the user's scope of authority. Such exposure violates fundamental principles of data confidentiality and can lead to serious regulatory non-compliance in industries governed by strict data protection laws like GDPR or HIPAA. Furthermore, access to detailed financial records without proper authorization undermines internal audit trails and trust within organizational structures relying on ERPNext for accurate reporting.
This vulnerability is classified under CWE-269, which addresses Improper Privilege Management, specifically highlighting the failure to enforce role-based restrictions during data retrieval operations. From a tactical perspective aligned with the MITRE ATT&CK framework, this flaw facilitates unauthorized access to sensitive information and can be leveraged for reconnaissance or intelligence gathering by malicious insiders or external attackers who have obtained valid credentials but lack high-level privileges. The attack vector is remote if authentication services are exposed over a network, making it particularly dangerous in cloud-hosted deployments where credential theft via phishing or brute force attacks could lead directly to this exploitation path.
To mitigate this risk, organizations running ERPNext must immediately upgrade their instances to version 15.118.0 or later for the v15 branch, or version 16.27.0 and later for the v16 branch. These releases contain patches that correctly enforce document permission checks within the Sales Person-wise Transaction Summary report queries. Until an upgrade is performed, administrators should consider restricting network access to ERPNext instances through firewalls or reverse proxies if possible, although this does not fully remediate the internal logic flaw. Additionally, implementing strict monitoring and logging of financial data access patterns can help detect anomalous behavior indicative of exploitation attempts while patching efforts are underway. Regular security audits and penetration testing focused on role-based access controls are recommended to identify similar weaknesses in other modules before they can be exploited by adversaries seeking unauthorized financial intelligence.