Summary
A high-severity privilege escalation vulnerability in Frappe ERPNext allows an authenticated user to create records while permission checks are disabled. By supplying a privileged record type to the affected creation endpoint, a user with no operational role may create privileged accounts and potentially take full control of the site.
A high-severity privilege escalation vulnerability in Frappe ERPNext allows an authenticated user to create records while permission checks are disabled. By supplying a privileged record type to the affected creation endpoint, a user with no operational role may create privileged accounts and potentially take full control of the site.
Affected context
The vulnerability occurs in ERPNext deployments where an authenticated record-creation endpoint accepts the record type from the request and creates that record without enforcing the normal permission model. It is relevant when low-privileged users can reach the endpoint and the server trusts the requested record type instead of deriving authorization from the authenticated user's role and permitted operations.
The vulnerability occurs in ERPNext deployments where an authenticated record-creation endpoint accepts the record type from the request and creates that record without enforcing the normal permission model. It is relevant when low-privileged users can reach the endpoint and the server trusts the requested record type instead of deriving authorization from the authenticated user's role and permitted operations.
Exploit preconditions
- Attack surface: Authenticated record-creation endpoint
- Required access: Any valid authenticated account, including an account without an operational role
- Trigger point: Submission of a request that selects a privileged record type
- Why exploitation is possible: The endpoint disables or bypasses permission checks while allowing the requester to control the record type, enabling creation of privileged account records
- Attack surface: Authenticated record-creation endpoint
- Required access: Any valid authenticated account, including an account without an operational role
- Trigger point: Submission of a request that selects a privileged record type
- Why exploitation is possible: The endpoint disables or bypasses permission checks while allowing the requester to control the record type, enabling creation of privileged account records
Why this happens
The underlying flaw is an authorization design error in which user-controlled resource selection is combined with disabled permission enforcement. This violates least-privilege principles and maps to CWE-269: Improper Privilege Management, because the application permits a lower-privileged identity to perform an operation reserved for a more privileged role.
The underlying flaw is an authorization design error in which user-controlled resource selection is combined with disabled permission enforcement. This violates least-privilege principles and maps to CWE-269: Improper Privilege Management, because the application permits a lower-privileged identity to perform an operation reserved for a more privileged role.
Potential impact
- An authenticated user may gain administrative or other elevated privileges
- Unauthorized privileged accounts could be created
- The attacker could take control of the ERPNext site
- Business records and configurations could be modified or deleted
- Sensitive organizational data could be accessed
- Additional users or integrations could be affected through administrative changes
- An authenticated user may gain administrative or other elevated privileges
- Unauthorized privileged accounts could be created
- The attacker could take control of the ERPNext site
- Business records and configurations could be modified or deleted
- Sensitive organizational data could be accessed
- Additional users or integrations could be affected through administrative changes
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the server-side operation boundary and preventing clients from selecting privileged resource types without an explicit policy decision.
Common defensive patterns include:
- Enforce role and record-level permissions for every create operation
- Derive allowed record types from the authenticated user's capabilities rather than trusting request parameters
- Apply deny-by-default authorization for administrative and account-management records
- Separate privileged account provisioning from general-purpose record-creation endpoints
- Validate authorization before performing any insert or side effect
- Use least-privilege service identities and minimize administrative permissions
- Review existing accounts and audit logs for unexpected privileged-record creation
Mitigation generally focuses on enforcing authorization at the server-side operation boundary and preventing clients from selecting privileged resource types without an explicit policy decision.
Common defensive patterns include:
- Enforce role and record-level permissions for every create operation
- Derive allowed record types from the authenticated user's capabilities rather than trusting request parameters
- Apply deny-by-default authorization for administrative and account-management records
- Separate privileged account provisioning from general-purpose record-creation endpoints
- Validate authorization before performing any insert or side effect
- Use least-privilege service identities and minimize administrative permissions
- Review existing accounts and audit logs for unexpected privileged-record creation
How teams detect issues like this
Organizations can look for:
- Static-analysis findings where request-controlled entity types reach generic insert functions
- Code paths that disable permission checks or use administrative bypass flags
- Endpoints that create records before authorization decisions are completed
- Code review signals involving generic create APIs exposed to broadly authenticated users
- Audit events showing low-privileged accounts creating administrative users or privileged records
- Policy checks requiring explicit authorization tests for every privileged object type
Automated application-security and policy-analysis tools may help identify generic record-creation paths and missing authorization enforcement.
Organizations can look for:
- Static-analysis findings where request-controlled entity types reach generic insert functions
- Code paths that disable permission checks or use administrative bypass flags
- Endpoints that create records before authorization decisions are completed
- Code review signals involving generic create APIs exposed to broadly authenticated users
- Audit events showing low-privileged accounts creating administrative users or privileged records
- Policy checks requiring explicit authorization tests for every privileged object type
Automated application-security and policy-analysis tools may help identify generic record-creation paths and missing authorization enforcement.
