ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
Low
Partial disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
frappe:erpnext
References 7
https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645
https://github.com/frappe/erpnext/security/advisories/GHSA-qpvh-75wh-j645
https://github.com/frappe/erpnext/pull/55709
https://github.com/frappe/erpnext/pull/55709
https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f24…
https://github.com/frappe/erpnext/commit/2ae6451f10926bd12b6ce6c7dc40f08da83f2460
https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed24…
https://github.com/frappe/erpnext/commit/8c7a313a38dfe38c9e35ca41e91389bcfaed2404
https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243f…
https://github.com/frappe/erpnext/commit/ba936eefabb784805daa4c602b4baec9fc243ff8
https://github.com/frappe/erpnext/releases/tag/v15.112.0
https://github.com/frappe/erpnext/releases/tag/v15.112.0
https://github.com/frappe/erpnext/releases/tag/v16.22.0
https://github.com/frappe/erpnext/releases/tag/v16.22.0