CVE-2026-44442CWE-862

ERPNext: Unauthorised Document modification due to missing validation

Critical · published May 13, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
34.9
In the wild
Unconfirmed
What it is

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00417 · 34.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-13T21:11Z
EPSS history
Timeline
  • 13 MAY 21:11Z
    ERPNext: Unauthorised Document modification due to missing validation
    cvelistv5