Threats tagged 'ghsa-c3m9-x4pg-4p8g'

Frappe ERPNext versions before 15.121.4 and 16.x before 16.36.0 have a missing authorization vulnerability in the get_linked_payments_for_doc method. This flaw allows any authenticated user, including portal users, to supply arbitrary parameters and access Payment Ledger Entry allocation data for invoices and vouchers belonging to other companies.