Threats tagged 'ghsa-5wjf-fvgv-583h'

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the erpnext.buying.utils.get_linked_material_requests method. This flaw allows authenticated users, including portal users or users without roles, to retrieve open Purchase-type Material Requests from other companies by supplying item codes. The vulnerability arises because the method lacks proper document or company permission checks.