CVE-2026-124315

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.121.4 Frappe ERPNext versions 16.x prior to 16.36.0

Description Missing authorization in the whitelisted get bom items() and get bom diff() methods allows authenticated users, including those with portal or no-role access, to bypass BOM read permission checks. By calling get bom items() with a specific BOM name, an attacker can retrieve sensitive data including raw materials, quantities, rates, and costs.

Recommendations Update to version 15.121.4 or later. Update to version 16.36.0 or later.