Auth bypass in Frappe Erpnext
CVE-2026-13227
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNex…
Vulnerability class: Broken Access Control
Affected products
- Frappe Erpnext — versions 0
Weakness classification (CWE)
References
- help@fluidattacks.com (third-party-advisory)
- help@fluidattacks.com (product)
- help@fluidattacks.com (patch)
- help@fluidattacks.com (patch)
- help@fluidattacks.com (vendor-advisory)