Summary
A missing authorization vulnerability in Frappe ERPNext allows authenticated, low-privileged users to create documents through certain endpoints without appropriate role checks. When affected endpoints accept requests without verifying access to the target records, users may bypass role-based restrictions and create unauthorized business data.
A missing authorization vulnerability in Frappe ERPNext allows authenticated, low-privileged users to create documents through certain endpoints without appropriate role checks. When affected endpoints accept requests without verifying access to the target records, users may bypass role-based restrictions and create unauthorized business data.
Affected context
The issue occurs in ERPNext deployments using affected document-creation endpoints where authorization is not consistently enforced. An authenticated user with limited privileges may be able to submit requests involving records or document types outside the scope granted by their assigned roles. The risk depends on endpoint exposure, enabled functionality, and the permissions associated with the authenticated account.
The issue occurs in ERPNext deployments using affected document-creation endpoints where authorization is not consistently enforced. An authenticated user with limited privileges may be able to submit requests involving records or document types outside the scope granted by their assigned roles. The risk depends on endpoint exposure, enabled functionality, and the permissions associated with the authenticated account.
Exploit preconditions
- Attack surface: ERPNext HTTP or API endpoints used for document creation
- Required access: An authenticated account with limited ERPNext privileges
- Trigger point: A document-creation request handled by an endpoint that lacks adequate authorization checks
- Why exploitation is possible: The endpoint may validate authentication or request format without confirming that the user is authorized to create the document against the relevant record or scope
- Attack surface: ERPNext HTTP or API endpoints used for document creation
- Required access: An authenticated account with limited ERPNext privileges
- Trigger point: A document-creation request handled by an endpoint that lacks adequate authorization checks
- Why exploitation is possible: The endpoint may validate authentication or request format without confirming that the user is authorized to create the document against the relevant record or scope
Why this happens
The underlying flaw is an authorization enforcement gap in selected document-creation endpoints. Authentication establishes the caller's identity, but the affected request path does not reliably perform the role- and record-level permission checks required before allowing the operation. This behavior maps to CWE-862: Missing Authorization, in which a protected function can be reached without an effective authorization decision.
The underlying flaw is an authorization enforcement gap in selected document-creation endpoints. Authentication establishes the caller's identity, but the affected request path does not reliably perform the role- and record-level permission checks required before allowing the operation. This behavior maps to CWE-862: Missing Authorization, in which a protected function can be reached without an effective authorization decision.
Potential impact
- Authenticated users may create documents outside their assigned business scope
- Role-based access restrictions could be bypassed
- Unauthorized records or workflow objects may enter ERPNext
- Business data integrity and downstream processes could be affected
- Attackers could use unauthorized documents to support further privilege abuse
- Authenticated users may create documents outside their assigned business scope
- Role-based access restrictions could be bypassed
- Unauthorized records or workflow objects may enter ERPNext
- Business data integrity and downstream processes could be affected
- Attackers could use unauthorized documents to support further privilege abuse
General mitigation guidance
Mitigation generally focuses on making authorization checks mandatory for every document-creation path rather than relying on authentication or client-side controls.
Common defensive patterns include:
- Enforcing server-side role, ownership, and record-level authorization before document creation
- Applying a centralized authorization policy consistently across web and API endpoints
- Denying access by default when the required permission context is missing or ambiguous
- Limiting document fields and relationships to values permitted for the current user and tenant
- Running service components with the minimum data and administrative privileges required
- Testing authorization decisions independently from input validation and authentication tests
Mitigation generally focuses on making authorization checks mandatory for every document-creation path rather than relying on authentication or client-side controls.
Common defensive patterns include:
- Enforcing server-side role, ownership, and record-level authorization before document creation
- Applying a centralized authorization policy consistently across web and API endpoints
- Denying access by default when the required permission context is missing or ambiguous
- Limiting document fields and relationships to values permitted for the current user and tenant
- Running service components with the minimum data and administrative privileges required
- Testing authorization decisions independently from input validation and authentication tests
How teams detect issues like this
Organizations can identify similar weaknesses through:
- Static and semantic analysis for document-creation handlers that lack authorization calls
- Code review checks requiring an explicit server-side permission decision before protected operations
- Endpoint inventories comparing exposed create operations with documented role and record policies
- Negative authorization tests using low-privileged accounts and records outside their permitted scope
- Audit-log monitoring for unusual document creation by users without corresponding business permissions
- Policy enforcement in CI pipelines requiring authorization coverage for new API and controller endpoints
Organizations can identify similar weaknesses through:
- Static and semantic analysis for document-creation handlers that lack authorization calls
- Code review checks requiring an explicit server-side permission decision before protected operations
- Endpoint inventories comparing exposed create operations with documented role and record policies
- Negative authorization tests using low-privileged accounts and records outside their permitted scope
- Audit-log monitoring for unusual document creation by users without corresponding business permissions
- Policy enforcement in CI pipelines requiring authorization coverage for new API and controller endpoints
