Description
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | erpnext | < 15.112.0, 16.0.0-beta.1 – < 16.23.0 | 15.112.0 |
References
- GitHub Security Advisory (GHSA-fmr9-rm6j-cfpq) vendor-advisory
- VulnCheck Advisory: Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints third-party-advisory