CVE-2026-44448EPSS p3.7%

CVE-2026-44448CVE-2026-44448

frappe / erpnext

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.102.0 and 16.11.0, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 15.102.0 and 16.11.0.

Scoring

CVSS 5.9 ()
VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
EPSS0.14% probability of exploitation · percentile 3.7% · 2026-10-27T12:03:15Z
Last modified2026-10-26
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.