CVE-2026-124315 | Frappe ERPNext up to 15.121.3/16.35.x BOM Permission Check get_bom_items/get_bom_diff bom_name improper authorization

A vulnerability categorized as problematic has been discovered in Frappe ERPNext up to 15.121.3/16.35.x. The affected element is the function get_bom_items/get_bom_diff of the component BOM Permission Check. The manipulation of the argument bom_name results in improper authorization.

This vulnerability is identified as CVE-2026-124315. The attack can be executed remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More