CVE-2026-72906

Published: Aug 10, 2026Modified: Sep 8, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability: 2.8 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (6)

https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd

Source: security-advisories@github.com

https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2

Source: security-advisories@github.com

https://github.com/frappe/erpnext/pull/55781

Source: security-advisories@github.com

https://github.com/frappe/erpnext/releases/tag/v15.111.0

Source: security-advisories@github.com

https://github.com/frappe/erpnext/releases/tag/v16.22.0

Source: security-advisories@github.com

https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8

Source: security-advisories@github.com

Timeline

No history available yet.