Auth bypass in Frappe Erpnext

CVE-2026-13227

An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities. This issue affects ERPNext: before 15.115.0, before 16.26.0.

Vulnerability class: Broken Access Control

EPSS: 0.002 (16.2th percentile) — read the EPSS interpretation.

Affected products

Frappe Erpnext — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

help@fluidattacks.com (third-party-advisory)
help@fluidattacks.com (product)
help@fluidattacks.com (patch)
help@fluidattacks.com (patch)
help@fluidattacks.com (vendor-advisory)