CVE-2026-108373

Executive Summary

CVE-2026-108373 is an authorization bypass (CWE-862, Missing Authorization) in the open-source ERPNext Enterprise Resource Planning platform affecting versions prior to 15.118.0 and 16.27.0. A role-limited authenticated user can request certain endpoints of the "Sales Person-wise Transaction Summary" financial report, which then queries financial transaction rows without applying the requesting user's document permission match conditions — allowing disclosure of financial data beyond the user's assigned role. The flaw is network-reachable, requires only low privileges, and causes high confidentiality impact (CVSS 6.5), while integrity and availability are unaffected.

Technical Analysis

ERPNext is a free and open-source ERP built on the Frappe framework. According to the NVD description, the vulnerability resides in the authorization logic of certain endpoints serving the "Sales Person-wise Transaction Summary" report. Under normal ERPNext/Frappe behavior, document-level permissions are enforced per user role; report queries are expected to apply match conditions restricting returned rows to those the requesting user is permitted to view.

In the affected versions, the report's query path fails to enforce those proper authorization checks. When a role-limited authenticated user requests the affected financial report, the query evaluates financial transaction rows without applying the requesting user's document permission match conditions. The result is a horizontal/vertical privilege boundary failure: the user reads financial data beyond their permitted role — i.e., aggregate and line-level financial records covering sales persons or transactions they should not be able to see.

Class and mechanism:

• Vulnerability class: Missing Authorization (CWE-862), specifically an object/row-level authorization gap in a reporting endpoint.
• Attack surface: an authenticated HTTP endpoint exposing the Sales Person-wise Transaction Summary report.
• Trigger condition: authenticated low-privilege session issues a request to the affected report endpoint; the server-side query lacks permission-based row filtering.

The NVD description does not disclose specific function names, parameters, file paths, or endpoint URLs. No additional code-level detail (e.g., query construction, whitelist bypass behavior) can be asserted from the available data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms remote exploitation over the network with no user interaction, requiring only a standard authenticated account.

Note: patch confidence is 0/4 — the NVD text names fixed versions (15.118.0, 16.27.0), but no patch source or tracked advisory evidence is available in the provided dataset. Treat as UNPATCHED for operational purposes until the fixed versions are verified in your environment.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available; the attack chain below is inferred from the vulnerability class (missing authorization in a report endpoint) and the NVD description. No specific endpoint names, parameters, or code patterns are invented.

1. Reconnaissance / target identification An attacker identifies an internet-facing or internally reachable ERPNext instance (banner/login page; login title). From Shodan-style dorks such as http.title:"ERPNext" or http.html:"frappe", an attacker builds a target list. Any valid low-privilege account is sufficient; credentials may be obtained via phishing, credential reuse, leaked secrets, or — in shared/internal deployments — a legitimate but over-privileged-to-ERP-but-under-privileged-to-finance user.

2. Triggering the flaw class The actor authenticates with the role-limited session, maintains cookies/CSRF token as required, and requests the Sales Person-wise Transaction Summary report endpoint. Because the server-side query omits the requesting user's document permission match conditions, the report response includes transaction rows outside the user's permitted scope. No privilege escalation or admin interaction is required; UI:N.

3. Execution / payload methodology (class-level) This is a GET/read-style request against a report endpoint using valid session authentication. The "payload" is the crafted report request that exercises unfiltered rows — e.g., selecting the report with parameters that cause it to enumerate financial transactions. The attacker observes the returned financial data to confirm out-of-scope rows. No exploitation of memory corruption, injection, or upload is involved.

4. Post-exploitation impact The actor harvests financial transaction data (sales, amounts, customer/sales-person associations) beyond authorized scope, enabling competitive intelligence, fraud, insider trading, or further targeting of high-value accounts and customers. The data can be exfiltrated quietly, and repeated pulls can be used to build full financial pipelines over time; nothing in the vector (I:N/A:N) indicates data destruction or service disruption.

Impact Assessment

CVSS 3.1: 6.5 (Medium) — AV:N (network), AC:L (low), PR:L (low privileges), UI:N (none), S:U (unchanged), C:H (high confidentiality), I:N (no integrity), A:N (no availability).

Business impact:

• Confidentiality breach of financial data — transaction summaries reveal revenues, account activity, and sales-per-person relationships that a role-limited user must not see.
• Multi-tenant / SMB deployments: any authenticated user is a potential actor; the blast radius is large per instance.
• Regulatory/compliance risk: disclosure of financial records can trigger obligations under financial-data protection regimes, breach-notification duties, and internal audit escalation.
• Fraud / insider risk: internal users can covertly map financial activity without privilege elevation requests, complicating detection.

Affected systems: ERPNext deployments < 15.118.0 and < 16.27.0 that expose the reporting module and allow non-admin / limited-role accounts. Internet-exposed instances are of greatest concern.

Blast radius: per-instance, scoped to data queried through the affected report path; no persistence, code execution, or lateral movement is implied by CVE data.

Detection Guidance

Sigma Rule

title: ERPNext Sales Person-wise Transaction Summary Report Authorization Bypass Attempt
id: cve-2026-108373-erpnext-report-idor
status: experimental
description: Detects access to the ERPNext Sales Person-wise Transaction Summary report by low-privilege users, consistent with CVE-2026-108373 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108373
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
  product: erpnext
  service: http
detection:
  selection_path:
    cs-uri-stem|re: '(?i)(query-report|report-view|api/method/frappe\.desk\.query_report)'
  selection_report:
    cs-uri-query|contains:
      - 'Sales Person-wise Transaction Summary'
      - 'Sales_Personwise_Transaction_Summary'
      - 'Sales Personwise Transaction Summary'
  selection_response:
    sc-status: 200
  filter_admin:
    userRole|contains: 'System Manager'
  condition: selection_path and selection_report and selection_response and not filter_admin
falsepositives:
  - Legitimate finance users with authorized report access
  - Scheduled/reporting jobs run by administrators
level: medium
tags:
  - attack.t1213
  - cve.2026.108373

YARA Rule

rule CVE_2026_108373_ERPNext_SalesPersonReport_AuthBypass
{
    meta:
        description = "Detects ERPNext Sales Person-wise Transaction Summary report access patterns associated with CVE-2026-108373"
        author = "ValtersIT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108373"
        cve = "CVE-2026-108373"
        confidence = "medium"
    strings:
        $r1 = "Sales Person-wise Transaction Summary" ascii wide nocase
        $r2 = "Sales_Personwise_Transaction_Summary" ascii wide nocase
        $r3 = "query-report" ascii wide nocase
        $r4 = "frappe.desk.query_report" ascii wide nocase
        $r5 = "Sales Personwise Transaction Summary" ascii wide nocase
    condition:
        uint16(0) == 0x4854 and  // "HT" — HTTP traffic capture
        (1 of ($r1,$r2,$r5)) and
        (1 of ($r3,$r4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108373 ERPNext Sales Person-wise Transaction Summary Auth Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"query-report"; nocase; http.uri; content:"Sales"; nocase; http.uri; content:"Person"; nocase; http.uri; content:"Transaction"; nocase; http.uri; content:"Summary"; nocase; classtype:attempted-recon; reference:cve,2026-108373; sid:2026108373; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=2h
  [authentication where event.category == "authentication" and event.outcome == "success"]
  [network where event.category == "network"
    and url.path : "*query-report*"
    and url.query : ("*Sales Person-wise Transaction Summary*" or "*Sales_Personwise_Transaction_Summary*")
    and http.response.status_code == 200]
  [network where event.category == "network"
    and url.path : "*query-report*"
    and url.query : ("*Sales Person-wise Transaction Summary*" or "*Sales_Personwise_Transaction_Summary*")
    and http.response.status_code == 200]

Splunk SPL Query

index=web OR index=erpnext sourcetype=http:*
  (uri_path="*query-report*" OR uri="*query-report*")
  (uri_query="*Sales*Person*Transaction*Summary*" OR uri_query="*Sales_Personwise_Transaction_Summary*")
  status=200
| eval user=coalesce(user, cs_username, src_user)
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, dest, user, uri
| where count >= 2
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="erpnext,cve-2026-108373,">
  <rule id="1083731" level="10">
    <if_sid>31103,31108</if_sid>
    <match>query-report</match>
    <regex type="pcre2">(?i)Sales[_ ]?Person-?wise[_ ]?Transaction[_ ]?Summary</regex>
    <description>CVE-2026-108373: ERPNext Sales Person-wise Transaction Summary report accessed — possible authorization bypass</description>
    <mitre>
      <id>T1213</id>
    </mitre>
    <group>financial_data_exposure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Treat as unpatched until fixed versions are independently verified in your build.
• Restrict network exposure of ERPNext instances: place behind VPN / zero-trust gateway, and block public access to the reporting endpoints except for known administrative networks.
• Enforce strict role scoping: audit role profiles that can access financial reports; remove non-essential access to the Sales Person-wise Transaction Summary report until patched.
• Add WAF/virtual-patch rules matching the Suricata/Splunk patterns above to alert on low-privilege sessions hitting the report path.
• Review web access logs for report requests from role-limited accounts and pull affected data-return windows for potential disclosure assessment.

2. Patch/upgrade steps

• Upgrade to ERPNext 15.118.0 or 16.27.0 as identified by NVD. Validate with a staging instance, then production.
• Since patch evidence is 0/4 from tracked sources, verify the fixed version through the vendor's release notes/changelog before scheduling; confirm the fix enforces document permission match conditions on the report query.
• After upgrade, retest as a low-privilege user that out-of-scope rows are no longer returned.

3. Long-term hardening

• Implement routine authorization regression testing for report endpoints — verify each report applies user document permission filters.
• Apply least privilege to ERP roles and rotate/limit accounts with report access.
• Continuous monitoring: retain the Sigma/Suricata/EQL detections in SIEM and review alerts for repeat actors.
• Patch-management SLAs for ERP components; subscribe to ERPNext security advisories.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-108373
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• ERPNext project: https://github.com/frappe/erpnext
• Frappe/ERPNext releases (verify fixed versions 15.118.0 / 16.27.0): https://github.com/frappe/erpnext/releases
• CISA KEV: not listed as of reporting (KEV: NO); no known exploit-in-the-wild or threat-actor campaign evidence available in the provided dataset.