CVE-2026-4894 in ERPNext
Summary
by MITRE • 10/08/2026
A vulnerability has been identified regarding insufficient validation in the Frappe Cloud/ERPNext authentication process, which allows multiple email addresses to be accepted by manipulating the email field in the /api/method/press.api.account.signup endpoint. The vulnerability occurs when an unauthenticated remote attacker adds more than one email address. The service processes the entire value as a valid list of recipients and sends the OTP code to all addresses without proper validation of all added emails (only one of them needs to be valid). Exploiting this vulnerability would allow an attacker to:
* Obtain the authentication OTP; * Impersonate someone else in the registration process; * Register accounts using other people's email addresses without access to the mailbox; * Indirectly confirm the existence of already registered email addresses.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The identified vulnerability represents a critical flaw within the authentication and account provisioning logic of Frappe Cloud, specifically affecting the ERPNext platform infrastructure. This issue stems from insufficient input validation in the /api/method/press.api.account.signup endpoint, which is responsible for handling new user registrations via email verification. The core technical failure lies in how the backend service parses and validates the email field provided by the client during the signup request. Instead of enforcing strict adherence to a single, valid email address format or verifying that all listed addresses are legitimate and accessible, the system treats the input as an array of recipients without performing comprehensive validation on each entry. This architectural oversight allows an unauthenticated remote attacker to inject multiple email addresses into the field, bypassing standard checks by ensuring only one of the provided addresses is syntactically correct while others may be malformed or non-existent.
From a technical perspective, this flaw constitutes a classic case of improper input sanitization and validation failure. The server-side logic processes the entire value as a valid list of recipients for sending One-Time Password (OTP) codes. Because the system only requires one email address in the provided list to be valid to proceed with the OTP generation process, it fails to isolate or verify each individual entry independently. This behavior deviates from secure coding practices that mandate strict validation against all inputs before processing sensitive operations like identity verification. The lack of rigorous checking allows the application to accept a payload containing multiple addresses, triggering the delivery mechanism for authentication codes across all specified destinations without confirming ownership or accessibility of those mailboxes.
The operational impact of this vulnerability is severe and multifaceted, primarily enabling account takeover scenarios through social engineering and information disclosure. An attacker can exploit this flaw to obtain authentication OTPs intended for legitimate users by including their email address alongside the victim's in the signup request. Since the system sends codes to all listed addresses, the attacker gains access to the verification code sent to their own mailbox while ignoring those sent to the victim. This facilitates impersonation during the registration process, allowing the creation of fraudulent accounts under another person's identity without requiring control over that individual's email inbox. Furthermore, this mechanism serves as a powerful enumeration tool for attackers seeking to indirectly confirm the existence of registered email addresses within the system. By observing whether an OTP is generated or if specific error messages are returned based on the validity of at least one address in the list, adversaries can map out valid user accounts and build targeted lists for subsequent phishing or brute-force attacks.
In terms of industry standard classification, this vulnerability aligns with CWE-20: Improper Input Validation, as the application fails to validate input data against expected formats and constraints before processing it. Additionally, the exploitation technique relates to CWE-641: Improvement of Abstraction Errors, where the abstraction layer for handling email recipients does not adequately enforce business logic rules regarding unique or verified ownership. From a threat modeling perspective using MITRE ATT&CK frameworks, this vulnerability supports techniques associated with Account Manipulation and Credential Access, specifically enabling attackers to bypass multi-factor authentication mechanisms by intercepting verification codes through manipulated input fields rather than breaking cryptographic protections directly.
To mitigate this risk, immediate remediation efforts should focus on enforcing strict validation rules at the API level for the signup endpoint. The system must be configured to accept only a single email address per registration request or, if multiple addresses are supported for organizational purposes, each individual address must undergo independent verification and syntax checking before any OTP is generated. Implementing rate limiting and CAPTCHA challenges can also help mitigate automated exploitation attempts. Furthermore, adopting a principle of least privilege in the authentication flow ensures that sensitive actions like sending verification codes require explicit confirmation of ownership for every specified recipient, thereby preventing attackers from leveraging secondary or malicious addresses to intercept legitimate user credentials. Regular security audits and static code analysis focused on input validation patterns are recommended to prevent similar flaws in other parts of the application logic.