Threats affecting pkg:github/erpnext

CVE-2026-124316 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. The flaw exists in the whitelisted method erpnext.buying.utils.get_linked_material_requests, which lacks proper document or company permission checks. This allows authenticated users, including portal users or users without assigned roles, to supply item codes and retrieve open Purchase-type Material Requests belonging to other companies.

CVE-2026-124315 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. The flaw exists in the whitelisted methods get_bom_items and get_bom_diff, which bypass BOM read permission checks. This allows any authenticated user, including portal or no-role users, to retrieve detailed bill of materials data such as raw materials, quantities, rates, and costs without proper authorization.

CVE-2026-124314 is a missing authorization vulnerability in Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0. It affects the erpnext.crm.utils.get_open_activities function, allowing any authenticated user, including portal or no-role users, to supply arbitrary parameters to enumerate ToDo and Event records, exposing private calendar event details.

CVE-2026-124313 is a missing authorization vulnerability in Frappe ERPNext affecting versions before 15.121.4 and 16.x before 16.36.0. It allows any authenticated user, including portal users, to access Payment Ledger Entry allocation data for invoices and vouchers belonging to other companies by supplying arbitrary parameters to the get_linked_payments_for_doc method.

ERPNext versions 9.0.0 through 16.50.0 have a missing authorization vulnerability that allows authenticated users, including customer portal users, to access stock quantity information via certain whitelisted batch methods. This exposure enables attackers to list item batches with per-warehouse quantities without proper permission checks.

ERPNext versions 15.55.0 through 16.50.0 have an authorization vulnerability in the get_timesheet_html method. Authenticated portal users can view project timesheets without proper checks for hide_timesheets or project membership. This allows unauthorized access to timesheet details such as names, status, time-log dates, and last modifiers.

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted methods before passing them to frappe.call(). Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and read their return values.

CVE-2026-94113 is an information disclosure vulnerability in Frappe ERPNext affecting versions before 15.121.0 and 16.x before 16.34.0. The flaw exists in whitelisted timesheet endpoints that do not enforce doctype permissions, allowing authenticated attackers to access sensitive billable time log data without proper authorization.