CVE-2026-124315 Details
Description
Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call get_bom_items with a BOM name to retrieve every raw material, quantity, rate and cost.
A missing authorization vulnerability has been identified in Frappe ERPNext versions prior to 15.121.4 and 16.x prior to 16.36.0. The vulnerability exists in the 'get_bom_items' and 'get_bom_diff' methods, which are whitelisted but lack proper permission checks for reading Bill of Materials (BOM) data. As a result, any authenticated user, including those with no roles or portal access, can retrieve detailed information about raw materials, quantities, rates, and costs associated with any BOM by calling 'get_bom_items' with the name of the BOM.
Users can upgrade to Frappe ERPNext versions 15.121.4 or 16.36.0 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Frappe ERPNext | < 15.121.4 (semver) < 16.36.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | New CVE Received | [email protected] |