CVE-2026-72909: ERPNext: Broken Access Control on certain endpoints
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepareconditions path in erpnext/accounts/report/accountsreceivable/accountsreceivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 15.112.0 - Upgrade
Upgrade
ERPNextto a version that resolves this vulnerability.Fixed in 16.23.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72909?
CVE-2026-72909 has a risk rating of 56.
What vulnerabilities does CVE-2026-72909 introduce in ERPNext?
CVE-2026-72909 introduces a broken access control vulnerability on certain endpoints that does not enforce Customer and Supplier user permissions.
How do I fix CVE-2026-72909?
To fix CVE-2026-72909, you should upgrade to ERPNext version 15.112.0 or later, or 16.23.0 or later.
Which versions of ERPNext are affected by CVE-2026-72909?
CVE-2026-72909 affects versions prior to 15.112.0 and 16.23.0 of ERPNext.
What specific functionality is impacted by CVE-2026-72909?
CVE-2026-72909 impacts the Payment Ledger endpoint, affecting access control based on user permissions.