CVE-2026-13227
NONE—CVSS v3
—CVSS v2
0.25%
EPSS (exploit probability)
CWE-862CWE
Description
An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erpnext.crm.doctype.prospect.prospect.get_opportunities.
This issue affects ERPNext: before 15.115.0, before 16.26.0.
Affected routers (0)
No routers currently mapped to this CVE in our database.