PT-2026-110926 · Frappe · Erpnext

William Pierson

·

CVE-2026-109377

·

Published

2026-10-12

·

Updated

2026-10-12

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get batch qty, get batches by oldest or get pos reserved batch qty to list every item batch with per-warehouse quantities.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-109377

Affected Products

Erpnext