CVE-2026-72909

Received Received - Intake

Unauthorized Financial Data Exposure in ERPNext

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72909

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	erpnext	to 16.23.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

ERPNext is an open-source Enterprise Resource Planning tool. A vulnerability exists in versions before 15.112.0 and 16.23.0 where the ReceivablePayableReport does not enforce user permissions on the Payment Ledger Entry party field. This allows any authenticated user to access unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports.

Detection Guidance

To detect this vulnerability, check if your ERPNext instance is running a vulnerable version (prior to 15.112.0 or 16.23.0). Review Accounts Receivable and Accounts Payable reports for unauthorized cross-company financial data access. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows unauthorized users to view sensitive financial data across different companies within ERPNext. It could lead to data breaches, financial fraud, or compliance violations if exploited by malicious actors.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive financial data to unauthorized users. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access risks regulatory penalties.

Mitigation Strategies

Immediately upgrade ERPNext to version 15.112.0 or 16.23.0 or later. Review and restrict user permissions to ensure proper access controls are enforced on financial reports.

Hi! I’m here to help you understand CVE-2026-72909. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70