CVE-2026-72910

Received Received - Intake

Unauthorized Data Modification in ERPNext

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: GitHub, Inc.

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-72910

Affected Vendors & Products

Vendor	Product	Version / Range
erpnext	erpnext	to 16.22.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

ERPNext versions before 15.112.0 and 16.22.0 have a vulnerability in several functions (merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, update_cost_center) that do not check for required write permissions. This allows authenticated users with limited privileges to modify protected data beyond their assigned roles.

Detection Guidance

Detecting this vulnerability requires checking ERPNext versions and reviewing access logs for unauthorized modifications to accounts or financial data. Verify if your ERPNext version is below 15.112.0 or 16.22.0. Check application logs for unusual activity in functions like merge_account or process_payment_reconciliation.

Impact Analysis

An attacker with limited access could alter financial records, job statuses, release dates, or cost centers, leading to data integrity issues, incorrect financial reporting, or unauthorized changes to critical business processes.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity requirements in GDPR and HIPAA. It may result in non-compliance due to improper access controls and potential data tampering.

Mitigation Strategies

Immediately upgrade ERPNext to version 15.112.0 or 16.22.0 or later. Review user permissions to ensure limited users do not have excessive write access. Audit recent changes to financial records or accounts for unauthorized modifications.

Hi! I’m here to help you understand CVE-2026-72910. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70