PT-2026-139489

CVE-2026-124313

Published

2026-11-07

Updated

2026-11-07

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.4 Frappe ERPNext versions 16.x prior to 16.36.0

Description An authorization flaw exists in the whitelisted get linked payments for doc() method. Authenticated users, including those with portal access, can provide arbitrary values for the company, doctype, and docname variables to access Payment Ledger Entry allocation data belonging to invoices and vouchers of other companies.

Recommendations Update to version 15.121.4 or later. Update to version 16.36.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Diptanilsaha

Shohruh Yoldoshov

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization