ERPNext CSRF Vulnerability: How to Lose Control of Your Account in Seconds!
ERPNext 14.82.1 is vulnerable to account takeover via Cross-Site Request Forgery (CSRF). This flaw allows attackers to perform unauthorized actions like user deletion or role assignment without the admin’s knowledge, making it a hacker’s dream come true. Remember, with great power comes great responsibility—or at least a CSRF token.
Hot Take:
Well, it looks like ERPNext has a bit of a CSRF crisis on its hands. Who knew that a simple click could turn you into an unwilling accomplice in the wild world of unauthorized admin actions? Maybe it’s time they ERPNext-level their security game!
Key Points:
- ERPNext versions 14.82.1 and 14.74.3 have a CSRF vulnerability.
- Admins are vulnerable to account takeovers, unauthorized role assignments, and user deletions.
- The application fails to enforce CSRF tokens on critical API requests.
- Mitigation steps include enforcing CSRF protection and re-authentication for critical changes.
- Public disclosure of the vulnerability was made on April 29, 2025.
Already a member? Log in here