Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_payments_for_doc

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.

Etkilenen sürümler1 yazılım

Kaynaklar8 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…rpnext/security/advisories/GHSA-hf2q-xhq6-q394 Üretici bülteni
• github.com/…ommit/48635ee6b56a08dc5663d283d8e29c4e30190ad3 Yama
• github.com/…ommit/aea326869b4f7ba96629eaec7e5d2eff3957c364 Yama
• vulncheck.com/…-authorization-via-get-linked-payments-for-doc Üçüncü taraf
• github.com/…ype/unreconcile_payment/unreconcile_payment.py Diğer
• github.com/frappe/erpnext Diğer

Kayıt geçmişi

1. 7 Kas 2026 17:17Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-124316Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_linked_material_requests
• 6,5 CVE-2026-124314Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_open_activities
• 6,5 CVE-2026-124315Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items
• 5,3 CVE-2026-119522WordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability
• 5,3 CVE-2026-123461WordPress FOX plugin <= 1.5.6 - Broken Access Control vulnerability
• 6,5 CVE-2026-120836WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Broken Access Control vulnerability