Frappe ERPNext reflected XSS allows account takeover (CVE-2025-71432)

What happened

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting flaw caused by missing input validation on a certain page. A remote attacker can prepare a crafted URL that, when opened by a logged-in user, executes arbitrary JavaScript inside that user's authenticated session. The attacker does not need prior access to the system, but must convince a logged-in user to open the link. The CVE record describes the outcome as account takeover. The CVSS 4.0 score is 8.6, or high severity. The CVE record lists no active exploitation and no public disclosure.

Who is affected

Affected versions are ERPNext before 14.92.1 and ERPNext 15.0.0 up to before 15.83.0. The CVE record names no other products. If you run ERPNext on either the 14.x or 15.x track, compare your exact build against these fixed versions. Because a logged-in user must open a crafted URL, instances where users handle links or email while authenticated are particularly exposed.

What to do now

1. Apply the fixed versions: upgrade to ERPNext 14.92.1 on the 14.x track, or ERPNext 15.83.0 on the 15.x track. These are the only fixed versions listed in the CVE record.
2. Inventory every ERPNext instance, including test and satellite deployments, and confirm the running version.
3. No vendor workaround is listed in the CVE record. Until upgrades are complete, restrict network access to ERPNext to trusted users and networks.
4. Review privileged ERPNext accounts for changes or additions you did not authorise.
5. Remind users not to follow unexpected or unsolicited ERPNext links while authenticated.

How to detect it

The CVE record does not provide specific indicators of compromise. Because the stated impact is account takeover, review ERPNext authentication logs for logins from new locations or devices and check high-privilege accounts for unexplained privilege changes or new credentials.

Beyond the patch

ERPNext sits at the centre of business processes, so an account takeover is a serious operational event. Because this weakness is reachable over the network without credentials, reducing exposed ERPNext access is part of the long-term fix. Our Virtual CISO Services (vCISO) can help map and reduce that exposure, and our Implementation & Assessment Services can test a web-facing ERPNext deployment and its hardening controls.