CVE-2026-72906: ERPNext: Unauthorised triggering of automated emails due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the sendautoemail function in erpnext/accounts/doctype/processstatementofaccounts/processstatementofaccounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72906?
The severity of CVE-2026-72906 is medium with a score of 4.3.
How do I fix CVE-2026-72906?
To fix CVE-2026-72906, upgrade your ERPNext installation to version 15.111.0 or 16.22.0 or later.
What is the main issue described in CVE-2026-72906?
CVE-2026-72906 involves unauthorized triggering of automated emails due to a missing permission check in the send_auto_email function.
Who is affected by CVE-2026-72906?
Users of ERPNext prior to versions 15.111.0 and 16.22.0 are affected by CVE-2026-72906.
What impact does CVE-2026-72906 have?
CVE-2026-72906 may allow authenticated users to send automated emails without proper authorization.