CVE-2026-44442

CRITICAL CVSS 9.9 View on NVD ↗

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9

Published: May 13, 2026 22:16 UTC Modified: May 14, 2026 16:45 UTC