CVE-2026-13227: CWE-862 Missing Authorization in Frappe ERPNext
CVE-2026-13227 is a high severity improper authorization vulnerability in Frappe ERPNext. It affects versions before 15.115.0 and 16.26.0 due to insufficient access control in a whitelisted API method related to CRM prospects. This flaw could allow unauthorized users with limited privileges to access sensitive opportunity data. The vulnerability has a CVSS 4.0 base score of 7.1, indicating significant impact but no known active exploitation. No official patch or remediation guidance is currently confirmed from the vendor.
AI Analysis
Technical Summary
An improper authorization vulnerability (CWE-862) exists in ERPNext versions prior to 15.115.0 and 16.26.0. The issue arises from insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities, which could allow users with limited privileges to access data they should not be authorized to view. This vulnerability is tracked as CVE-2026-13227 with a CVSS 4.0 score of 7.1 (network attack vector, low attack complexity, no privileges required, no user interaction, high impact on confidentiality). No vendor advisory or patch information is currently available.
Potential Impact
The vulnerability allows unauthorized access to opportunity data via a whitelisted API method in affected ERPNext versions. This could lead to exposure of sensitive customer relationship management information. There are no known exploits in the wild at this time. The impact is limited to confidentiality breaches without elevation of privileges or integrity/availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API method and limit user privileges to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.
CVE-2026-13227: CWE-862 Missing Authorization in Frappe ERPNext
Description
CVE-2026-13227 is a high severity improper authorization vulnerability in Frappe ERPNext. It affects versions before 15.115.0 and 16.26.0 due to insufficient access control in a whitelisted API method related to CRM prospects. This flaw could allow unauthorized users with limited privileges to access sensitive opportunity data. The vulnerability has a CVSS 4.0 base score of 7.1, indicating significant impact but no known active exploitation. No official patch or remediation guidance is currently confirmed from the vendor.
CVSS v4.0
Score 7.1high
Affected software
Frappe
ERPNext
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An improper authorization vulnerability (CWE-862) exists in ERPNext versions prior to 15.115.0 and 16.26.0. The issue arises from insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities, which could allow users with limited privileges to access data they should not be authorized to view. This vulnerability is tracked as CVE-2026-13227 with a CVSS 4.0 score of 7.1 (network attack vector, low attack complexity, no privileges required, no user interaction, high impact on confidentiality). No vendor advisory or patch information is currently available.
Potential Impact
The vulnerability allows unauthorized access to opportunity data via a whitelisted API method in affected ERPNext versions. This could lead to exposure of sensitive customer relationship management information. There are no known exploits in the wild at this time. The impact is limited to confidentiality breaches without elevation of privileges or integrity/availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API method and limit user privileges to trusted users only. Monitor vendor channels for updates and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Fluid Attacks
- Date Reserved
- 2026-06-24T16:42:20.788Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a72559fbf8831d53976f7ef
Added to database: 08/04/2026, 21:11:59 UTC
Last enriched: 08/12/2026, 15:31:12 UTC
Last updated: 09/18/2026, 10:01:29 UTC
Views: 73
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.