CVE-2026-72909: CWE-284: Improper Access Control in frappe erpnext
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
AI Analysis
Technical Summary
CVE-2026-72909 is an improper access control vulnerability (CWE-284) in the ERPNext open source ERP software. Specifically, in versions before 15.112.0 and 16.23.0, the function prepare_conditions in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not enforce Customer and Supplier user permissions on the Payment Ledger Entry dynamic-link party field. This allows any authenticated user to read financial data across companies that they should not have access to, affecting Accounts Receivable and Accounts Payable reports. The vulnerability is fixed in versions 15.112.0 and 16.23.0.
Potential Impact
Authenticated users with limited permissions can access unauthorized financial data across companies in ERPNext, violating data confidentiality and potentially exposing sensitive accounting information. This could lead to data leakage within organizations using affected ERPNext versions.
Mitigation Recommendations
Upgrade ERPNext to version 15.112.0 or later, or 16.23.0 or later, where this access control issue is fixed. No other mitigation or temporary workaround is specified. Patch status is confirmed fixed in these versions.
CVE-2026-72909: CWE-284: Improper Access Control in frappe erpnext
Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.23.0, the ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field, allowing any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. This issue is fixed in versions 15.112.0 and 16.23.0.
CVSS v4.0
Score 7.1high
Affected software
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-72909 is an improper access control vulnerability (CWE-284) in the ERPNext open source ERP software. Specifically, in versions before 15.112.0 and 16.23.0, the function prepare_conditions in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not enforce Customer and Supplier user permissions on the Payment Ledger Entry dynamic-link party field. This allows any authenticated user to read financial data across companies that they should not have access to, affecting Accounts Receivable and Accounts Payable reports. The vulnerability is fixed in versions 15.112.0 and 16.23.0.
Potential Impact
Authenticated users with limited permissions can access unauthorized financial data across companies in ERPNext, violating data confidentiality and potentially exposing sensitive accounting information. This could lead to data leakage within organizations using affected ERPNext versions.
Mitigation Recommendations
Upgrade ERPNext to version 15.112.0 or later, or 16.23.0 or later, where this access control issue is fixed. No other mitigation or temporary workaround is specified. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-10T17:57:26.143Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b1b2ebf8831d539bca7b1
Added to database: 08/11/2026, 12:53:02 UTC
Last enriched: 08/11/2026, 12:55:54 UTC
Last updated: 08/12/2026, 00:41:14 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.