CVE-2026-72907: ERPNext: Broken Access Control on certain endpoint
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.111.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72907?
The severity of CVE-2026-72907 is medium with a score of 6.5.
What are the affected versions in CVE-2026-72907?
CVE-2026-72907 affects ERPNext versions prior to 15.111.0 and 16.22.0.
How do I fix CVE-2026-72907?
To fix CVE-2026-72907, upgrade to ERPNext versions 15.111.0 or 16.22.0 or later.
What type of vulnerability is CVE-2026-72907?
CVE-2026-72907 is classified as a Broken Access Control vulnerability.
Who can exploit CVE-2026-72907?
CVE-2026-72907 can be exploited by authenticated limited users to create unauthorized accounts.