CVE-2026-109377

Medium

Description

ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.

SeverityMedium

CVSS4.3

Exploit probability—

Product

ERPNext

PublishedOct 12, 2026

First seenOct 12, 2026

Weakness typeCWE-862Missing authorization

How to fix

Patches

github.com/frappe/erpnext/pull/60147
github.com/frappe/erpnext/commit/10a2400312afd17df740c6ed64e0803dfbabb623

Affected products

Product	Affected versions	Fixed in
Frappe ERPNext	9.0.0 ≤ v ≤ 16.50.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.