ERPNext versions prior to 15.111.0 and 16.22.0 contain an improper authorization vulnerability (CWE-285) in the add_ac function of erpnext/accounts/utils.py. The function accepts the ignore_permissions argument but does not enforce the Account create permission, allowing authenticated users with limited privileges to create unauthorized accounting master records. This flaw can affect the integrity of financial data and audit trails. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The issue is fixed in ERPNext versions 15.111.0 and 16.22.0.

An authenticated user with limited privileges can bypass permission checks to create unauthorized accounting master records. This compromises the integrity of financial data and audit trails, potentially leading to inaccurate financial reporting or manipulation of accounting records. There is no impact on confidentiality or availability.

Upgrade ERPNext to version 15.111.0 or later, or 16.22.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is documented. Patch status is confirmed fixed in these versions.