CVE-2026-72910: ERPNext: Unauthorised modification of master data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the mergeaccount, pausejobfordoc, triggerjobfordoc, changereleasedate, and updatecostcenter functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/processpaymentreconciliation/processpaymentreconciliation.py, erpnext/accounts/doctype/purchaseinvoice/purchaseinvoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erpnextto a version that resolves this vulnerability.Fixed in 15.112.0 - Upgrade
Upgrade
erpnextto a version that resolves this vulnerability.Fixed in 16.22.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72910?
The severity of CVE-2026-72910 is high with a score of 7.1.
How do I fix CVE-2026-72910?
To fix CVE-2026-72910, upgrade to ERPNext versions 15.112.0 or 16.22.0 or later.
What is affected by CVE-2026-72910?
CVE-2026-72910 affects the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions in ERPNext.
Can CVE-2026-72910 lead to unauthorized data modification?
Yes, CVE-2026-72910 can allow unauthorized modification of master data due to missing validation.
What are the consequences of exploitation of CVE-2026-72910?
Exploitation of CVE-2026-72910 could result in unauthorized changes to critical business data within ERPNext.