Threats tagged 'ghsa-66vp-2c6m-m4r6'

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the get_bom_items and get_bom_diff methods. These methods skip Bill of Materials (BOM) read permission checks, allowing any authenticated user, including those with portal or no roles, to retrieve sensitive BOM data such as raw materials, quantities, rates, and costs.