CVE-2026-44448

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/frappe/erpnext/security/advisories/GHSA-444j-g95x-5pqv	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:frappe:erpnext::::::::
	cpe:2.3:a:frappe:erpnext::::::::

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) ERPNext es una herramienta de Planificación de Recursos Empresariales gratuita y de código abierto. Antes de las versiones 15.102.0 y 16.11.0, ciertos puntos finales no aplicaron controles de autorización adecuados, permitiendo a los usuarios modificar datos más allá de su rol permitido. Esta vulnerabilidad se corrigió en las versiones 15.102.0 y 16.11.0.

Information

Published : 2026-05-13 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-44448

Mitre link : CVE-2026-44448

CVE.ORG link : CVE-2026-44448

JSON object : View

Products Affected

frappe

erpnext

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44448", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44448", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T12:41:27.256500Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frappe", "product": "erpnext", "versions": [{"status": "affected", "version": ">= 16.0.0-beta.1, < 16.11.0"}, {"status": "affected", "version": "< 15.102.0"}]}]}], "published": "2026-05-13T22:16:45.913", "references": [{"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-444j-g95x-5pqv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0."}, {"lang": "es", "value": "ERPNext es una herramienta de Planificaci\u00f3n de Recursos Empresariales gratuita y de c\u00f3digo abierto. Antes de las versiones 15.102.0 y 16.11.0, ciertos puntos finales no aplicaron controles de autorizaci\u00f3n adecuados, permitiendo a los usuarios modificar datos m\u00e1s all\u00e1 de su rol permitido. Esta vulnerabilidad se corrigi\u00f3 en las versiones 15.102.0 y 16.11.0."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38037660-498A-414C-A2F8-E279ACDA57F3", "versionEndExcluding": "15.102.0"}, {"criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01E75E4A-356A-48DF-9903-40DEC5106C96", "versionEndExcluding": "16.11.0", "versionStartIncluding": "16.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}