CVE-2026-44442

critical · 9.9

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.1, certain endpoints failed to enforce proper authorization checks, allowing users to modify data beyond their permitted role. This vulnerability is fixed in 16.9.1.

9.9

CVSS

0.3%

EPSS (exploit prob.)

21st

EPSS percentile

2026-05-13

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-862

Affected products

Vendor	Product	Affected versions
frappe	erpnext	< 16.9.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/frappe/erpnext/security/advisories/GHSA-cg5w-7g26-p3w9

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-44442