Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Published: 2026-08-10
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

ERPNext’s add_ac function accepts an ignore_permissions flag without validating the caller’s Account create permission. An authenticated user with limited privileges can therefore create new accounting master records, which corrupts financial data and undermines audit trails.

Affected Systems

The vulnerability is present in ERPNext builds from the frappe:erpnext product before releases 15.111.0 and 16.22.0. All earlier versions of ERPNext are affected.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated user who can access the add_ac endpoint and supply the ignore_permissions flag; this bypasses normal permission checks and can be used to insert unauthorized accounting data. The issue has been corrected in the listed releases.

Generated by OpenCVE AI on August 10, 2026 at 22:36 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.111.0 or newer, or to 16.22.0 or newer, depending on your installation.
  • If a patch cannot be applied immediately, modify the add_ac endpoint or configuration to reject requests that include the ignore_permissions flag, or enforce the Account create permission programmatically.
  • Audit existing accounting master records for unexpected entries and adjust the audit trail to reflect any unauthorized changes.
  • Monitor logs for attempts to invoke the add_ac endpoint with the ignore_permissions parameter and block such activity if it persists.

Generated by OpenCVE AI on August 10, 2026 at 22:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 13 Aug 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe erpnext
Vendors & Products Frappe
Frappe erpnext

Mon, 10 Aug 2026 21:00:00 +0000

Type Values Removed Values Added
Description ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.
Title ERPNext: Broken Access Control on certain endpoint
Weaknesses CWE-285
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-13T15:50:03.387Z

Reserved: 2026-08-10T17:57:26.143Z

Link: CVE-2026-72907

cve-icon Vulnrichment

Updated: 2026-08-13T15:49:59.908Z

cve-icon NVD

Status : Received

Published: 2026-08-10T21:17:25.460

Modified: 2026-08-13T16:19:02.680

Link: CVE-2026-72907

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T02:45:06Z

Weaknesses