CVE-2026-72907 in ERPNext
Summary
by MITRE • 08/11/2026
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in ERPNext affects versions prior to 15.111.0 and 16.22.0, specifically targeting the add_ac function within erpnext/accounts/utils.py. This flaw represents a critical access control bypass that undermines the fundamental security architecture of financial data management systems. The issue stems from improper permission validation where the function accepts an ignore_permissions argument but fails to enforce proper Account create permissions, creating a pathway for unauthorized modifications to accounting master records.
The technical implementation of this vulnerability demonstrates a classic insufficient permission check flaw that aligns with CWE-285, which addresses authorization issues in software applications. When an authenticated user invokes the add_ac function with the ignore_permissions parameter, the system bypasses normal permission validation mechanisms that should prevent creation of accounting entries without proper authorization. This behavior creates a direct attack vector where users with limited privileges can manipulate core financial data structures.
The operational impact of this vulnerability extends beyond simple data modification to compromise the integrity of entire financial audit trails and reporting systems. Accounting master records represent foundational elements of any ERP system's financial integrity, and unauthorized creation of these records can lead to significant discrepancies in financial statements, tax reporting, and regulatory compliance. The flaw allows attackers to introduce phantom accounts or modify existing ones without proper authorization, potentially enabling financial fraud or data manipulation that could go undetected for extended periods.
From a threat modeling perspective, this vulnerability maps directly to ATT&CK technique T1078 which covers valid accounts and privilege escalation. The attack surface is particularly concerning given that ERPNext systems typically handle sensitive financial information and the vulnerability affects core accounting functionality. Organizations using affected versions face potential risks including unauthorized financial transactions, data integrity compromise, and violations of financial auditing standards such as SOX compliance requirements.
The fix implemented in versions 15.111.0 and 16.22.0 addresses this issue by enforcing proper permission checking when the ignore_permissions argument is used. This remediation ensures that even when developers choose to bypass normal permission checks for specific use cases, the system maintains appropriate authorization controls for critical accounting functions. Organizations should prioritize immediate upgrade to these fixed versions while implementing additional monitoring of accounting master record creation activities to detect any potential exploitation attempts.
Security teams should also consider implementing automated scanning tools to identify systems running vulnerable ERPNext versions and establish baseline configurations that prevent unauthorized permission bypass mechanisms from being enabled in production environments. The vulnerability highlights the importance of proper input validation and authorization enforcement in financial applications, particularly those handling sensitive data types that require strict access controls and audit trail integrity.