CVE-2026-13227: ERPNext Auth Bypass Vulnerability

CVE-2026-13227 Overview

CVE-2026-13227 is an improper authorization vulnerability in ERPNext, the open-source ERP built on the Frappe framework. The flaw affects the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities, which fails to enforce sufficient access controls. Authenticated users with low privileges can invoke this endpoint over the network and retrieve opportunity records associated with prospects they should not be able to view. The issue is tracked as CWE-862: Missing Authorization and impacts ERPNext versions prior to 15.115.0 and prior to 16.26.0.

Critical Impact
Authenticated attackers can enumerate confidential CRM opportunity data across the tenant without needing elevated roles, exposing sales pipeline and customer relationship information.

Affected Products

ERPNext versions prior to 15.115.0
ERPNext versions prior to 16.26.0
Deployments exposing the Frappe whitelisted API surface

Discovery Timeline

2026-08-04 - CVE-2026-13227 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-13227

Vulnerability Analysis

ERPNext exposes server-side Python methods to the client through Frappe's @frappe.whitelist() decorator. The get_opportunities method under erpnext.crm.doctype.prospect.prospect is decorated as whitelisted, making it callable by any authenticated session. The method returns opportunities linked to a supplied prospect but does not verify that the calling user has read permission on the prospect or the related opportunities. As a result, the endpoint acts as a confused deputy, returning data that bypasses the DocType permission model normally enforced by Frappe.

The vulnerability primarily affects confidentiality. Opportunity records commonly contain deal values, contact details, sales stages, and internal notes. An attacker with any authenticated ERPNext account, including a low-privileged user such as a limited employee or portal user, can iterate prospect identifiers and harvest sensitive CRM data.

Root Cause

The root cause is missing authorization on a whitelisted API method. The function relies on the whitelist decorator for authentication but omits per-record permission checks such as frappe.has_permission() or frappe.get_doc().check_permission(). Any caller reaching the endpoint bypasses role-based access control on the underlying DocTypes.

Attack Vector

Exploitation is performed over the network against the ERPNext HTTP API. An authenticated attacker sends a POST request to /api/method/erpnext.crm.doctype.prospect.prospect.get_opportunities with a target prospect name in the request body. The server returns the associated opportunities regardless of whether the caller has permissions on those records. Enumeration of prospect names, which follow predictable naming series in ERPNext, allows large-scale data extraction. No user interaction is required and no elevated privileges are needed beyond a valid login.

See the GitHub Security Advisory GHSA-g8r3-82j6-wp48 and the Fluid Attacks Security Advisory for additional technical context.

Detection Methods for CVE-2026-13227

Indicators of Compromise

Repeated HTTP requests to /api/method/erpnext.crm.doctype.prospect.prospect.get_opportunities from a single authenticated session.
Sequential or scripted enumeration of prospect parameter values in ERPNext access logs.
Unusual volumes of opportunity data reads originating from low-privileged accounts or portal users.

Detection Strategies

Review ERPNext web server logs and Frappe audit trails for calls to get_opportunities that do not correlate with normal CRM user workflows.
Baseline API usage per user role and flag deviations, particularly non-sales roles invoking prospect or opportunity endpoints.
Correlate API access with the user's permitted DocType permissions to identify sessions retrieving records outside their role scope.

Monitoring Recommendations

Enable verbose access logging on the Frappe/ERPNext application server and forward logs to a centralized analytics platform.
Alert on bursts of /api/method/* calls exceeding a per-user threshold within a short window.
Track authentication events for portal and limited-role accounts to detect credential abuse preceding API enumeration.

How to Mitigate CVE-2026-13227

Immediate Actions Required

Upgrade ERPNext to version 15.115.0 or 16.26.0 or later without delay.
Audit recent access logs for calls to get_opportunities and identify any accounts that may have exfiltrated data.
Rotate credentials for any accounts suspected of abuse and review portal user provisioning.

Patch Information

The Frappe team addressed the missing authorization check in ERPNext releases v15.115.0 and v16.26.0. Administrators should follow the standard ERPNext upgrade path using bench update and verify the deployed version after upgrade. Source code is available in the GitHub ERPNext Repository.

Workarounds

Restrict network access to the ERPNext API to trusted IP ranges using a reverse proxy or WAF rule.
Disable or block the specific endpoint path /api/method/erpnext.crm.doctype.prospect.prospect.get_opportunities at the proxy layer until patching is complete.
Tighten role assignments and remove unnecessary CRM DocType access from portal and low-privilege users.

bash

# Configuration example
bench switch-to-branch version-15 erpnext --upgrade
bench update --patch
bench --site your-site.local migrate
bench --site your-site.local version | grep erpnext