https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-08T14:10:43.095050+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-124315 CVE-2026-124315 — Frappe ERPNext before 15.121.4 and 16.36.0 Missing Authorization via get_bom_items 2026-11-08T14:10:43.097426+00:00

Affected: frappe erpnext

Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted get_bom_items and get_bom_diff methods that skip BOM read permission checks. Any authenticated user, including portal or no-role users, can call get_bom_items with a BOM name to retrieve every raw material, quantity, rate and cost.