ERPNext Access Validation Vulnerability in Payment Request Endpoint Allowing Unauthorized Document Access

A vulnerability in ERPNext, an open-source Enterprise Resource Planning tool, has been identified in versions prior to 15.98.1 and in the 16.0.0-rc.1 release, as well as in versions through 16.6.0. Certain endpoints in these versions lacked proper access validation, which resulted in unauthorized access to documents. This issue has been addressed in ERPNext versions 15.98.1 and 16.6.1.

Impact

Exploitation of this vulnerability allowed for unauthorized access to documents through specific endpoints, due to the absence of proper access validation.

Remediation

Users are advised to upgrade to ERPNext version 15.98.1 or 16.6.1.