CVE-2026-13227CWE-862broken-access-control

CVE-2026-13227

published August 5, 2026

CVSS
7.1
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.

This issue affects ERPNext: before 15.115.0, before 16.26.0.

The record
Technical detail
CVSS
7.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-05T01:16Z
References (6)
https://fluidattacks.com/es/advisories/kraviz · [email protected]https://github.com/frappe/erpnext · [email protected]https://github.com/frappe/erpnext/releases?page=2#release-v15.115.0 · [email protected]https://github.com/frappe/erpnext/releases?page=2#release-v16.26.0 · [email protected]https://github.com/frappe/erpnext/security/advisories/GHSA-g8r3-82j6-wp48 · [email protected]https://fluidattacks.com/es/advisories/kraviz · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 04 AUG 20:53Z
    ERPNext v16.25.0 - Improper authorization in Prospect opportunities API
    cvelistv5