CVE-2026-109377: Missing Authorization in Frappe ERPNext

CVE-2026-109377 describes a missing authorization vulnerability in Frappe ERPNext affecting versions 9.0.0 through 16.50.0. Authenticated users can invoke whitelisted batch methods such as get_batch_qty, get_batches_by_oldest, and get_pos_reserved_batch_qty to retrieve detailed stock quantities across warehouses. This bypasses intended access controls, exposing inventory data to unauthorized users including those with limited portal access.

The vulnerability allows unauthorized disclosure of stock quantity information to authenticated users who should not have access to this data. This could lead to information leakage about inventory levels, potentially aiding attackers in planning further attacks or competitive intelligence gathering. There is no indication of privilege escalation or code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to affected batch methods where possible and monitor user permissions to limit exposure. Avoid granting unnecessary authenticated access to customer portal users.