Open-source business platforms, week 38 2026: Shopware and ERPNext authorisation flaws lead 51 advisories

The release at a glance

Between 14 and 20 September 2026, the maintainers of these platforms published 51 vulnerabilities: 5 carry CVE identifiers and 46 are tracked by GitHub security advisories. By severity, 3 are critical, 21 high, 19 medium, 2 low and 6 unscored. Frappe / ERPNext accounts for 31 of the entries, WordPress for 11, Shopware for 5 and Nextcloud for 4.

None of the vulnerabilities in this release is listed in CISA's Known Exploited Vulnerabilities catalogue, and the advisories do not report active exploitation. The work concentrates in Shopware and ERPNext, where the critical and high-severity entries sit.

What matters most

In Shopware, GHSA-r432-q883-wgvf is the most serious: a webhook permission check can bypass event ACLs and expose customer, order or email data (CVSS 9.6). GHSA-2qxr-vvj4-5934 allows an unauthenticated Store API client to read database content when PHP before 8.4 runs with PDO MySQL emulated prepares enabled (CVSS 8.6). GHSA-8xfc-pww7-3rm5 lets an authenticated administration user with profile self-edit rights promote themselves to administrator (CVSS 8.1). All three have their own advisory pages on this site.

In ERPNext, GHSA-v38v-9h2p-hr8v is critical SQL injection accessible to any authenticated user, including one with no assigned roles, and can lead to privilege escalation (CVSS 9.6). GHSA-rv4r-c8v3-3hrc is a critical stored XSS on a public-facing booking page that can take over a privileged session (CVSS 9.3). GHSA-f99r-gp2w-xghj and GHSA-734c-hv9r-mg2c are stored XSS in report and tool views respectively (CVSS 8.7 each). GHSA-jp5q-723q-g826 is high-severity SQL injection that can extract sensitive information (CVSS 7.7). Further ERPNext advisories cover missing authorisation for data modification, status changes and record creation.

Patch in this order

1. Patch Shopware to 6.6.10.25 or 6.7.14.1. This addresses the webhook data exposure (GHSA-r432-q883-wgvf), the Store API SQL injection (GHSA-2qxr-vvj4-5934) and the profile-update privilege escalation (GHSA-8xfc-pww7-3rm5).
2. Until Shopware patching is complete, use the published workarounds: restrict webhook:create and review webhook registrations and delivery logs for GHSA-r432-q883-wgvf; for GHSA-2qxr-vvj4-5934, upgrade PHP to 8.4 or later or disable PDO MySQL emulated prepares; for GHSA-8xfc-pww7-3rm5, restrict Administration access or remove the user_change_me permission and review administrator accounts.
3. Patch ERPNext. Start with 15.119.1 / 16.32.0 for GHSA-rv4r-c8v3-3hrc and GHSA-jp5q-723q-g826; 15.120.0 / 16.33.0 for GHSA-f99r-gp2w-xghj; 15.121.0 / 16.33.0 for GHSA-jfwr-g9v2-57c9; 15.121.0 / 16.34.0 for GHSA-v38v-9h2p-hr8v, GHSA-wp9w-rxmg-6pfj and GHSA-vr45-2p9x-3vjc; 15.121.3 / 16.35.0 for GHSA-cgjf-xw8x-qjjc; and 15.112.0 / 16.23.0 for GHSA-734c-hv9r-mg2c.
4. After those, move through the remaining WordPress, Nextcloud and lower-severity ERPNext advisories in the table according to where each product is internet-facing and how the severity lines up with your environment.

Beyond the patch

The patterns in this release are familiar: missing authorisation and input validation in ERPNext, and webhook and property-boundary weaknesses in Shopware. An Implementation & Assessment Services engagement can test public Shopware and ERPNext instances and harden them before these classes of flaw are reached, while Managed Detection & Response gives EDR and SIEM coverage for the code execution, privilege escalation or credential abuse that would follow if a critical entry is exploited.