CVE-2026-44441 is a Server-Side Request Forgery vulnerability in the ERPNext product by frappe. Versions before 15.106.0 and between 16.0.0-beta.1 and 16.16.0 are affected. The flaw allows an attacker with limited privileges to craft requests that cause the server to perform HTTP calls to attacker-chosen services. This could potentially be used to access internal resources or services not normally accessible to the attacker. The vulnerability is fixed in ERPNext versions 15.106.0 and 16.16.0.

The vulnerability allows an attacker with limited privileges to induce the server to make HTTP requests to arbitrary services, which could lead to unauthorized internal network access or information disclosure. The CVSS score of 5.0 indicates a medium impact primarily on confidentiality. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade ERPNext to version 15.106.0 or later, or 16.16.0 or later, where this SSRF vulnerability is fixed. Since this is an on-premises product, patching by upgrading to the fixed versions is the recommended remediation. Patch status is confirmed by the vendor advisory stating the fix is included in these versions.