{"identifier":"CVE-2026-44442","cve":{"id":"CVE-2026-44442","description":"ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.","published":"2026-05-13T22:16:45.350000+00:00","modified":"2026-10-26T14:10:00.130000+00:00","status":"Analyzed","score":9.9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"16.9.1"}],"weaknesses":["CWE-862"],"references":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9","source":"security-advisories@github.com","tags":["Vendor Advisory"]}],"kev":null,"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":9.9,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.1,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-05-14T16:03:55.309846Z","id":"CVE-2026-44442","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*","versionEndExcluding":"16.9.1","matchCriteriaId":"566D19AF-E92B-47C1-9676-F2CD5DE6A51B"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T10:25:01.156389+00:00","exploited":false,"kev_stale":false,"products":["frappe / erpnext"],"priority":{"label":"Critical technical severity","reasons":["CVSS is at least 9.0; exploitation is not established by severity alone."]},"epss":{"probability":0.00279,"percentile":0.20318,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"github.com","source_url":"https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9","investigate_url":"https://investigate.aeglixmind.com/#github.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-44442","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-44442","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-44442","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}