Permission Management Flaw in ERPNext Affects Data Security
CVE-2026-72910

7.1HIGH

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
10 August 2026

What is CVE-2026-72910?

ERPNext, an open-source ERP solution, has a significant vulnerability that allows authenticated limited users to modify sensitive data outside of their assigned roles. This flaw exists in multiple functions across various Python files, where crucial write permission checks have been omitted. Users may exploit this vulnerability to make unauthorized changes. The issue has been addressed in versions 15.112.0 and 16.22.0, highlighting the importance of updating to ensure comprehensive access control.

Affected Version(s)

erpnext < 15.112.0 < 15.112.0

erpnext >= 16.0.0, < 16.22.0 < 16.0.0, 16.22.0

References

https://github.com/frappe/erpnext/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/frappe/erpnext/pull/55709
x_refsource_MISC
https://github.com/frappe/erpnext/commit/2ae6451f10926bd1...
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.