CVE-2026-55242 | ERPNext is a free and open source Enterprise Resource Planni… | CVSS 8.8 HIGH

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, an authenticated user with a standard operational role can trigger server-side template injection through a configuration field, resulting in unauthorized disclosure of data outside the user's normal permission scope. This issue is fixed in versions 15.111.0 and 16.22.0.

Metadata

CVE ID: CVE-2026-55242
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-06-16 16:44 UTC
Published: 2026-07-15 15:38 UTC
Last updated: 2026-07-15 16:02 UTC
Primary CWE: CWE-863
CWE-863: Incorrect Authorization
Vendor / Product: frappe / erpnext
Sources: cve.org · NVD

Severity & Metrics

8.8 HIGH CVSS 3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
frappe	erpnext	—	< 15.111.0, >= 16.0.0, < 16.22.0

Weakness (CWE)

CWE	Source	Description
CWE-1336	cna	CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
CWE-863	cna	CWE-863: Incorrect Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.8	HIGH	3.1	cna	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References (1)

https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j https://github.com/frappe/erpnext/security/advisories/GHSA-pxf3-4gvc-v45j