{"schema":"threatline.record/2","record":{"id":"CVE-2026-109377","aliases":[],"summary":"ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods","details":"ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_batches_by_oldest or get_pos_reserved_batch_qty to list every item batch with per-warehouse quantities.","categories":["Unclassified"],"product":"ERPNext","vendor":"Frappe","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-109377","source_modified_at":"2026-10-15T13:51:52.605Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"ERPNext","vendor":"Frappe","versions":[{"version":"9.0.0","status":"affected","versionType":"semver","lessThanOrEqual":"16.50.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00251,"percentile":0.15535,"score_date":"2026-10-23"},"published_at":"2026-10-12T20:55:09.844Z","modified_at":"2026-10-15T13:51:52.605Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-109377","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-15T13:51:52.605Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-109377","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/frappe/erpnext/pull/60147","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/frappe/erpnext/commit/10a2400312afd17df740c6ed64e0803dfbabb623","tags":["patch"]},{"source":"CVE List","url":"https://github.com/frappe/erpnext/blob/v16.50.0/erpnext/stock/doctype/batch/batch.py#L235-L301","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/frappe/erpnext","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/erpnext-9.0.0-through-16.50.0-missing-authorization-in-batch-lookup-methods","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-15T13:51:41.864216Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-15T13:51:52.605Z","content_hash":"00da59fb59abd11bc577008b3f72b7e53e5cbb1fa2df2507ab246750d1574ffe"}}