ERPNext v15.111.0: Permission Bypass Fixes and Data Integrity Patches

Vulnerability Overview This webpage snapshot primarily describes several bug fixes and improvements in ERPNext v15.111.0, involving potential security vulnerabilities and permission issues. Affected Scope 1. Permission Bypasses: - The system now requires permissions to add new accounts; the flag no longer bypasses this check. - The "Update Items" operation respects the "allow edit only" setting when submitting documents. - Access checks are added before account lookups display balances or related document details. - also checks access permissions before loading unpaid documents. - Submitted records can no longer be edited. - is allowed to update the consumed material costs of linked without requiring edit permissions for the . - Only system administrators can create or update print formats for . - When creating inter-company purchase invoices, only the remaining quantity is displayed. - Related documents now include billing, taxes, payment terms, and contact details. - The "Stock Ageing" report now accepts multiple items. - Validation is added to the PDF Name field in , and permissions are checked before sending automated emails. 2. Data Integrity Issues: - The "Create Variant" dialog in the form is updated to display numbers without decimal places. - Validation for is updated to include asset items. - Validation is added to to ensure finished goods use serial or batch numbers linked to the selected . - The indicator is updated to consider delivered quantities. - When duplicating and records, original primary contact and address details are no longer retained. - is stored in records to populate existing records. - Sales of sample inventory from warehouses configured with in are blocked. - The status now displays "In Progress" when material transfer is skipped. - The "Addresses and Contacts" report now processes address details using city and country prefixes. - Batch prefixes in are now handled as plain text. - The "Inactive Sales Items" report now uses safer database queries. Remediation 1. Permission Management: - The system now requires permissions to add new accounts; the flag no longer bypasses this check. - The "Update Items" operation respects the "allow edit only" setting when submitting documents. - Access checks are added before account lookups display balances or related document details. - also checks access permissions before loading unpaid documents. - Submitted records can no longer be edited. - is allowed to update the consumed material costs of linked without requiring edit permissions for the . - Only system administrators can create or update print formats for . - When creating inter-company purchase invoices, only the remaining quantity is displayed. - Related documents now include billing, taxes, payment terms, and contact details. - The "Stock Ageing" report now accepts multiple items. - Validation is added to the PDF Name field in , and permissions are checked before sending automated emails. 2. Data Integrity: - The "Create Variant" dialog in the form is updated to display numbers without decimal places. - Validation for is updated to include asset items. - Validation is added to to ensure finished goods use serial or batch numbers linked to the selected . - The indicator is updated to consider delivered quantities. - When duplicating and records, original primary contact and address details are no longer retained. - is stored in records to populate existing records. - Sales of sample inventory from warehouses configured with in are blocked. - The status now displays "In Progress" when material transfer is skipped. - The "Addresses and Contacts" report now processes address details using city and country prefixes. - Batch prefixes in are now handled as plain text. - The "Inactive Sales Items" report now uses safer database queries. POC Code or Exploit Code No specific POC code or exploit code is included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

ERPNext v15.111.0: Permission Bypass Fixes and Data Integrity Patches

More from this source