CVE-2026-108373

MediumCVSS 6.5/10Last modified Oct 19, 2026

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query can query financial transaction rows without applying the requesting user's document permission match conditions. This allows the user to read financial data beyond the user's permitted role. This issue is fixed in versions 15.118.0 and 16.27.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 19, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1083747.7ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modificatioCVE-2026-1083758.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083768.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083778.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083788.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083798.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083808.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083818.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083828.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083838.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083848.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from AvrCVE-2026-1083858.8dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avr
CVE-2026-108373: Medium severity, CVSS 6.5 | Vulnix