Vulnerability · Published Aug 10, 2026 · Assigned by GitHub_M

CVE-2026-72909ERPNext: Broken Access Control on certain endpoints

High 7.1

In plain English

A high-severity improper access control in erpnext from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 59.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.

Affected products (as reported)

Vendor	Product	Versions
frappe	erpnext	< 15.112.0>= 16.0.0, < 16.23.0

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/frappe/erpnext/security/advisories/GHSA-p577-cxv9-h82f x_refsource_CONFIRM
https://github.com/frappe/erpnext/pull/55696 x_refsource_MISC
https://github.com/frappe/erpnext/commit/b05abbc53b3655b02db17ba2e8165519f195c1c2 x_refsource_MISC
https://github.com/frappe/erpnext/commit/c03a66a1bf48a53c42d01c9d936d9b22aa013e11 x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v15.112.0 x_refsource_MISC
https://github.com/frappe/erpnext/releases/tag/v16.23.0 x_refsource_MISC