by Kastro
Paper/Archive/CVE-2026-44442

CVE-2026-44442

frappe erpnext — ERPNext: Unauthorised Document modification due to missing validation

EPSS 0.3%CVSS 9.9
critical.is priorityof 100
34
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 20.4.204 × 204.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

Affected

ProductAffectedFixed inSource
erpnext< 16.9.1–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9