CVE-2026-124313

4.3 MEDIUMpublic exploit available

Published 2026-11-07 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_linked_payments_for_doc method. Any authenticated user, including portal users, can supply arbitrary company, doctype, and docname values to read Payment Ledger Entry allocation data for other companies' invoices and vouchers.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-862

Public exploit & PoC references

https://github.com/frappe/erpnext
https://github.com/frappe/erpnext/blob/12cd563fb9a79731f75ae2a45b1446a0a2dd9e74/erpnext/accounts/doctype/unreconcile_payment/unreconcile_payment.py#L104-L105
https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3
https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364
https://github.com/frappe/erpnext/security/advisories/GHSA-hf2q-xhq6-q394

All references

https://github.com/frappe/erpnext
https://github.com/frappe/erpnext/blob/12cd563fb9a79731f75ae2a45b1446a0a2dd9e74/erpnext/accounts/doctype/unreconcile_payment/unreconcile_payment.py#L104-L105
https://github.com/frappe/erpnext/commit/48635ee6b56a08dc5663d283d8e29c4e30190ad3
https://github.com/frappe/erpnext/commit/aea326869b4f7ba96629eaec7e5d2eff3957c364
https://github.com/frappe/erpnext/security/advisories/GHSA-hf2q-xhq6-q394
https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.4-and-16.36.0-missing-authorization-via-get-linked-payments-for-doc

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2025-11455
MEDIUMCVE-2025-12523PoC
MEDIUMCVE-2025-1397
MEDIUMCVE-2025-14484
MEDIUMCVE-2025-14486
MEDIUMCVE-2025-14487
MEDIUMCVE-2025-62819
MEDIUMCVE-2025-7043

Related by shared AI tags and CWE weakness class. Browse the full archive.