CVE-2026-44442

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) ERPNext es una herramienta de Planificación de Recursos Empresariales gratuita y de código abierto. Antes de la versión 16.9.1, ciertos puntos finales no aplicaban las comprobaciones de autorización adecuadas, lo que permitía a los usuarios modificar datos más allá de su rol permitido. Esta vulnerabilidad está corregida en la versión 16.9.1.

Information

Published : 2026-05-13 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44442

Mitre link : CVE-2026-44442

CVE.ORG link : CVE-2026-44442

JSON object : View

Products Affected

frappe

erpnext

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44442", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44442", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T16:03:55.309846Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "erpnext", "versions": [{"status": "affected", "version": "< 16.9.1"}]}]}], "published": "2026-05-13T22:16:45.350", "references": [{"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1."}, {"lang": "es", "value": "ERPNext es una herramienta de Planificaci\u00f3n de Recursos Empresariales gratuita y de c\u00f3digo abierto. Antes de la versi\u00f3n 16.9.1, ciertos puntos finales no aplicaban las comprobaciones de autorizaci\u00f3n adecuadas, lo que permit\u00eda a los usuarios modificar datos m\u00e1s all\u00e1 de su rol permitido. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 16.9.1."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "566D19AF-E92B-47C1-9676-F2CD5DE6A51B", "versionEndExcluding": "16.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}