Joost Grunwald

An authorization flaw exists in the whitelisted `erpnext.buying.utils.get linked material requests()` method. The function fails to perform necessary document or company permission checks. Consequently, authenticated users, such as portal users or those without assigned roles, can provide item codes to retrieve open Purchase-type Material Requests associated with other companies.

A broken access control issue exists in the Mautic Stats API endpoint '/api/stats/{table}'. The system failed to enforce permissions for several internal tables, as administrator-only restrictions were not applied and tables lacking explicit permission mappings remained readable by default. Consequently, any authenticated API user, regardless of their assigned role or permissions, can access sensitive data. This includes the application audit log containing user actions and change details that may expose personal contact data, visitor IP addresses, geolocation details, and tracked redirect URLs with channel mappings.

An account takeover issue exists due to a flawed account-matching condition. The system incorrectly uses the `username exists($userName)` function regardless of the configured matcher, which allows an identity provider (IdP) asserted username to match any existing WordPress account unconditionally. This enables unauthenticated attackers to log in as any existing user, including administrators, by asserting a matching username in a crafted SAML response.

The issue allows an attacker to brute-force all possibilities of 2FA codes, which are 6 digits long, due to the lack of rate limiting on 2FA validation attempts.