CVE-2025-28062 Details
Description
A Cross-Site Request Forgery (CSRF) vulnerability was discovered in ERPNEXT 14.82.1 and 14.74.3. The vulnerability allows an attacker to perform unauthorized actions such as user deletion, password resets, and privilege escalation due to missing CSRF protections.
A Cross-Site Request Forgery (CSRF) vulnerability exists in ERPNext versions 14.82.1 and 14.74.3. This vulnerability allows attackers to perform unauthorized actions such as deleting users, resetting passwords, and escalating privileges. The issue arises from inadequate CSRF protection on essential administrative API endpoints. If an authenticated administrator visits a malicious website, their session can be exploited to execute these actions without their consent.
To address this vulnerability, ERPNext should implement CSRF tokens on all state-changing API endpoints, disallow GET requests for actions such as saving or deleting, mark authentication cookies with 'SameSite=Strict', and require re-authentication for critical actions like password or role changes.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frappe/erpnext | [email protected] | Product |
| https://github.com/Thvt0ne/CVE-2025-28062 | [email protected] | Exploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| frappe erpnext | 14.74.3 14.82.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2025 | Initial Analysis | [email protected] |
| May 13, 2025 | CVE Modified | CISA-ADP |
| May 5, 2025 | New CVE Received | [email protected] |