CVE-2026-72906 PUBLISHED

ERPNext: Unauthorised triggering of automated emails due to missing validation

Assigner: GitHub_M
Reserved: 10.08.2026 Published: 10.08.2026 Updated: 10.08.2026

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS Score: 4.3

Product Status

Vendor frappe
Product erpnext
Versions
  • Version < 15.111.0 is affected
  • Version >= 16.0.0, < 16.22.0 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE