CVE-2026-72907
Received Received - Intake

Unauthorized Account Creation in ERPNext

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72907

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
erpnext erpnext to 16.22.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in ERPNext allows an authenticated user with limited permissions to create unauthorized accounting master records by exploiting the add_ac function in erpnext/accounts/utils.py. The function accepts the ignore_permissions argument without enforcing Account create permission, which can affect financial data integrity and audit trails.

Impact Analysis

An attacker could exploit this to create unauthorized accounting records, potentially altering financial data, disrupting audit trails, and compromising the integrity of financial reporting within the ERP system.

Compliance Impact

This vulnerability could lead to unauthorized changes in financial records, violating compliance requirements for data integrity and auditability in standards like GDPR and HIPAA. It may result in non-compliance penalties and loss of trust in financial reporting.

Mitigation Strategies

Upgrade ERPNext to version 15.111.0 or later for the 15.x branch, or to version 16.22.0 or later for the 16.x branch. This will address the unauthorized account creation issue by enforcing proper permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72907. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart