CVE-2026-72910 in ErpNext
Summary
by MITRE • 08/11/2026
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability identified in ERPNext affects multiple critical functions across various accounting modules including account management, payment reconciliation, purchase invoicing, and utility operations. This represents a significant authorization bypass flaw that permits authenticated users with limited privileges to execute administrative operations typically restricted to authorized personnel. The affected functions encompass merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center which collectively operate across core accounting document types and utility modules. These functions are designed to modify critical financial data including account relationships, payment processing workflows, invoice statuses, release dates, and cost center allocations that form the foundation of enterprise financial management systems.
The technical root cause stems from insufficient permission validation within the application's access control mechanisms. Specifically, the affected Python modules in erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py lack proper write permission checks before executing sensitive operations. This absence of authorization verification creates a path for privilege escalation where users with minimal access rights can manipulate financial records through direct function calls. The vulnerability manifests as a failure to implement mandatory authorization checks that should validate user permissions against specific operational contexts before allowing data modifications.
The operational impact of this vulnerability extends beyond simple unauthorized data modification to encompass potential financial fraud, audit trail manipulation, and system integrity compromise. Limited users could theoretically merge accounts to obscure transactions, pause or trigger payment processing workflows to disrupt cash flow management, modify release dates to alter financial reporting periods, or change cost centers to redistribute expenses unfairly. This represents a direct violation of the principle of least privilege and could enable attackers to manipulate financial data that impacts decision-making processes, compliance reporting, and internal controls. The vulnerability affects organizations using ERPNext versions prior to 15.112.0 and 16.22.0, creating a window of exposure where unauthorized modifications can occur without detection.
Security practitioners should recognize this issue as aligning with CWE-284 (Improper Access Control) and represents a critical authorization bypass vulnerability that falls under ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing). The vulnerability demonstrates how insufficient input validation combined with inadequate permission checks creates exploitable paths for privilege escalation. Organizations should implement immediate mitigations including mandatory version upgrades to 15.112.0 or 16.22.0, comprehensive access control reviews, and enhanced monitoring of critical accounting functions. Additional defensive measures include implementing role-based access controls with granular permissions, conducting regular security audits of API endpoints, and establishing automated detection mechanisms for unauthorized administrative function calls. The fix implemented in the patched versions ensures proper authorization verification before execution of sensitive operations, thereby restoring the intended access control boundaries within the ERPNext platform.
This vulnerability highlights the critical importance of implementing robust access control validation throughout enterprise applications, particularly in financial management systems where unauthorized modifications can have cascading effects on organizational operations and regulatory compliance. The remediation process requires careful attention to ensure that all affected functions properly validate user permissions against their operational contexts while maintaining system functionality for legitimate users. Organizations should treat this as a high-priority security concern requiring immediate action to protect sensitive financial data integrity and maintain audit trail reliability across their ERPNext implementations.