CVE-2026-108374

Executive Summary

CVE-2026-108374 is a missing authorization vulnerability (CWE-862) in ERPNext, a free and open source Enterprise Resource Planning platform. Prior to versions 15.121.0 and 16.34.0, certain status-modification endpoints fail to enforce proper authorization checks, allowing a low-privileged authenticated user to invoke state-changing whitelisted methods without the required write, submit, cancel, document, or role checks. Successful exploitation permits modification of business data beyond the user's permitted role, resulting in high integrity impact across the ERP data model.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862). According to the NVD description, the flaw resides in "certain endpoints for status modification" that "fail to enforce proper authorization checks." ERPNext exposes server-side methods that are remotely callable, referred to in the description as "whitelisted methods." The core defect is that these state-changing methods perform insufficient validation of the caller's privileges before executing the state transition.

The description explicitly names the categories of checks that are missing: "write, submit, cancel, document, or role checks." This indicates the affected endpoints can be reached and executed by an authenticated user whose role would not normally permit those operations. Because the check enforcement is absent at the endpoint level, the framework's usual permission model (write permission, submit/cancel workflow permissions, document-level permissions, and role restrictions) is bypassed for the operations handled by these endpoints.

The attack surface is the HTTP-accessible application layer of ERPNext. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N indicates network reachability, low attack complexity, required low privileges, and no user interaction. Notably, the Scope is Changed (S:C) — meaning the vulnerable component's authorization failure can affect resources beyond its own security scope (i.e., the integrity impact propagates to other ERP documents and business records governed by a different authorization context). Confidentiality impact is None and Availability impact is None; the sole impact is High to Integrity.

No specific function names, route paths, parameter names, or code snippets are provided in the available intelligence. Therefore this analysis is confined to the vulnerability class and the semantics stated verbatim in the NVD description. No public proof-of-concept, Nuclei template, or exploit code has been identified for this CVE.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred strictly from the vulnerability class (CWE-862) and the NVD description. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. An attacker identifies an internet- or intranet-exposed ERPNext instance. This can be done via HTTP response fingerprinting (login page, framework assets, or favicon). The attacker confirms the running version is prior to 15.121.0 or 16.34.0.

2. Privilege acquisition (low). The attacker obtains any low-privileged authenticated account. Because the vulnerability requires only PR:L, a basic user account is sufficient. The low-privileged user does not need administrative, write, submit, or cancel role assignments.

3. Triggering the flaw class. The attacker invokes one of the state-changing "whitelisted methods" used for status modification. Because the endpoint fails to enforce the missing write, submit, cancel, document, or role checks, the request is processed despite the caller lacking the corresponding privileges. The vulnerability-class mechanism is an authorization bypass: the framework route/method is reachable and the state transition is committed without a permission gate.

4. Execution / payload level. The payload is a legitimate application request to a status-modification endpoint, issued by an authenticated but under-privileged session. No memory-corruption payload, injection string, or malformed input is required — the attack leverages normal request semantics against an under-protected endpoint.

5. Post-exploitation impact. The user can modify data beyond the user's permitted role. Given the S:C and I:H scoring, the integrity of ERP business records (e.g., document statuses and downstream business objects governed by workflows) can be altered. This could include transitioning a document to a state that would normally be restricted, thereby corrupting workflow integrity, audit trails, or downstream processing. Since Confidentiality and Availability impacts are None, the primary outcome is unauthorized data modification rather than data theft or denial of service.

Because no exploit code exists publicly, defenders should treat the above as a class-level model rather than a confirmed exploit chain.

Impact Assessment

The CVSS 3.1 base score is 7.7 (High). The subscores are:

• Attack Vector: Network (AV:N) — exploitable remotely over the network; no physical or adjacent access required.
• Attack Complexity: Low (AC:L) — no specialized conditions or race windows; the authorization gap is directly reachable.
• Privileges Required: Low (PR:L) — only a basic authenticated session is needed, not administrative access.
• User Interaction: None (UI:N) — no victim action is required.
• Scope: Changed (S:C) — the impact extends beyond the vulnerable component to other authorization contexts, meaning permission boundaries protecting other ERP records can be crossed.
• Confidentiality: None (C:N) — no direct disclosure of information.
• Integrity: High (I:H) — serious modification of protected business data is possible.
• Availability: None (A:N) — no denial-of-service effect.

Business impact: ERPNext is a central system of record for finance, inventory, manufacturing, HR, and CRM processes. Unauthorized status modifications can corrupt workflow state, bypass approval gates, and undermine the reliability of business records. The Scope:Changed rating signals that an attacker's actions can affect data objects outside the intended permission boundary. Because exploitation requires only a low-privileged account, the "blast radius" is large in environments with many basic users or self-service accounts (e.g., suppliers, customers, or field staff). Audit and compliance integrity is also at risk where status fields feed financial reporting or regulated workflows.

Affected systems: All ERPNext deployments running versions earlier than 15.121.0 (15.x branch) and earlier than 16.34.0 (16.x branch).

Detection Guidance

Sigma Rule

title: ERPNext Unauthorized Status Modification via Whitelisted Method
id: 8f2c1a94-3b17-4d6e-9a21-cve2026108374
status: experimental
description: Detects state-changing whitelisted method invocations against status modification endpoints in ERPNext by low-privileged users (CVE-2026-108374)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-108374
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: erpnext
detection:
  selection_method:
    http.method: 'POST'
  selection_path:
    http.url|contains:
      - 'status'
      - 'whitelisted'
  selection_status_code:
    http.status_code: 200
  condition: selection_method and selection_path and selection_status_code
falsepositives:
  - Legitimate users with proper roles performing authorized status changes
  - Automated workflow integrations with valid permissions
level: medium
tags:
  - attack.t1190
  - cwe.862

YARA Rule

rule CVE_2026_108374_ERPNext_Missing_Authz
{
    meta:
        description = "Detects ERPNext missing authorization status modification indicators (CVE-2026-108374)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108374"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "status modification" nocase
        $s2 = "whitelisted method" nocase
        $s3 = "erpnext" nocase
        $s4 = "/api/method/" nocase
    condition:
        uint32(0) == 0x504B0304 or filesize < 5MB
        and 2 of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108374 ERPNext Unauthorized Status Modification Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"status"; nocase; http.uri; content:"/api/method/"; nocase; classtype:attempted-admin; reference:cve,2026-108374; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-108374; sid:2026108374; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "POST" and http.request.uri contains "status"]
  [http where http.request.method == "POST" and http.request.uri contains "/api/method/" and http.response.status_code == 200]

Splunk SPL Query

index=web_logs sourcetype=erpnext_access
| search http_method=POST (uri_path="*status*" OR uri_path="*api/method*")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, http_status
| where http_status=200 and count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="erpnext,web,cve-2026-108374">
  <rule id="108374" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.method">POST</field>
    <field name="http.url" type="pcre2">(?i)(status|api/method/.*whitelisted)</field>
    <field name="http.status_code">200</field>
    <description>CVE-2026-108374: Possible ERPNext unauthorized status modification via whitelisted method</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cwe_862,attempted_admin,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence was found from any tracked source, and the vendor fix and workarounds fields are empty. The NVD description references fixed versions (15.121.0 and 16.34.0), but this has not been corroborated by tracked patch sources. Organizations should verify the availability of these releases directly with the ERPNext project before relying on them.

1) Immediate mitigations (if upgrading is not immediately possible):

• Restrict network access to the ERPNext instance. Place the application behind a VPN or zero-trust access proxy so only trusted networks can reach state-modification endpoints.
• Enforce least privilege on accounts. Audit all users and remove unnecessary accounts; limit the number of low-privileged users who can authenticate, since PR:L is sufficient to exploit.
• Apply Web Application Firewall (WAF) rules that restrict or alert on state-changing method calls to status endpoints from users without elevated roles.
• Increase monitoring and alerting on status-change operations, particularly those originating from accounts with minimal role assignments.
• Review ERPNext role definitions and document-level permission configurations to ensure the intended authorization model is enforced at the application configuration layer where possible.

2) Patch / upgrade steps:

• Upgrade ERPNext to version 15.121.0 or 16.34.0 once the official releases are confirmed available from the vendor.
• Validate the patch by verifying the version string post-upgrade and confirming that status-modification endpoints now enforce write, submit, cancel, document, and role checks.
• Test the authorization behavior with a low-privileged test account before returning the system to normal production exposure.

3) Long-term hardening:

• Implement centralized, server-side authorization middleware so that state-changing whitelisted methods cannot be invoked without explicit permission checks — avoid relying on client-side or per-endpoint ad hoc checks.
• Establish a secure development lifecycle (SDLC) process that includes automated authorization testing for every endpoint, mapped to CWE-862.
• Adopt continuous vulnerability management with subscription to vendor advisories and NVD feeds to catch authorization defects in ERP platforms promptly.
• Enforce audit logging of all state transitions and monitor for anomalies indicative of role-boundary violations.

References

• NVD — CVE-2026-108374: https://nvd.nist.gov/vuln/detail/CVE-2026-108374
• ERPNext project — official releases and advisories: https://github.com/frappe/erpnext
• CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — not yet scored at the time of writing (no EPSS value available).

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, Nuclei template, or exploit code have been identified for CVE-2026-108374. CISA KEV status: not listed.