ERPNext and Frappe Framework week 45 advisories: missing authorization checks expose data across modules

What happened

The ten advisories describe missing or incomplete authorization checks in ERPNext, plus one arbitrary file read in Frappe Framework. The affected endpoints, reports and forms check only a broad role or document-type permission instead of verifying that the authenticated caller can access the specific record requested. Every one of these flaws is reachable over the network, needs no user interaction, and requires only an authenticated account. In several cases that account can be a low-privilege user, a portal user, or a user with no assigned roles.

An attacker can read source documents through Payment Requests, email communications in CRM and Support, private e-invoice files in the Regional module, complete selling documents and RFQs through customer and supplier portal lists, customer documents through print and portal views, and child table rows of transactions. A separate Frappe Framework flaw allows authenticated arbitrary file read through file attachment handling. A number of the flaws also allow modification: replacing BOMs across the site, cancelling Stock Reservation Entries, and a set of state-changing endpoints some of which cross-site requests can trigger.

No exploitation is recorded in the advisories. The vendor states that no workaround is available and that upgrading is required.

Who is affected

ERPNext is the main affected product. All 15.x releases before 15.124.2 and all 16.x releases before 16.53.0 contain at least one of the flaws in this bundle; the specific fixed releases vary by advisory, with earlier fixes including 15.121.4, 15.122.0, 15.124.0, 16.36.0, 16.50.0 and 16.52.0. ERPNext deployments that use the Accounts, CRM, Support, Regional, Manufacturing, customer portal, supplier portal, print/portal views or shared document endpoints are within scope. Frappe Framework 15.x before 15.120.1 and 16.x before 16.33.1 are affected by the file attachment arbitrary file read.

What to do now

1. Upgrade ERPNext. The latest listed fixed versions are 15.124.2 for the 15.x line and 16.53.0 for the 16.x line. Earlier fixes include 15.121.4, 15.122.0, 15.124.0, 16.36.0, 16.50.0 and 16.52.0, depending on the advisory.
2. Upgrade Frappe Framework to at least 15.120.1 (15.x) or 16.33.1 (16.x) to close the arbitrary file read in file attachment handling.
3. Treat this as an upgrade, not a configuration change. The vendor has published no workaround for these flaws; upgrading is required. Until patched, restrict network exposure of ERPNext and Frappe instances, especially customer and supplier portal endpoints, and review activity as described below.

How to detect it

The advisories do not publish indicators of compromise. Review ERPNext and Frappe audit logs for unexpected reads of source documents through payment requests, CRM or support communications, regional e-invoice file downloads, portal customer and selling document lists, child table row queries, BOM replacement or BOM Update Log entries, and cancellation of stock reservation entries by accounts that would not normally perform those actions.

Beyond the patch

Because ERPNext typically holds financial, stock and pricing data, these missing authorization checks matter beyond a patch: an insider or a compromised low-privilege account can cross the boundaries that the application's permission model is supposed to enforce. A penetration test and hardening review from Implementation & Assessment Services can confirm that record-level permissions and portal exposure match your intended segregation of duties. For teams that run ERPNext or Frappe Framework as part of a wider set of supplier software, tracking upstream patch cadence belongs in Supply Chain Defense & Third-Party Risk.