CVE-2026-72906: ERPNext Auth Bypass Vulnerability

CVE-2026-72906 Overview

ERPNext is a free and open source Enterprise Resource Planning (ERP) tool built on the Frappe framework. The vulnerability affects the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. The function lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated statement-of-accounts emails outside the permitted role. The issue is classified as Missing Authorization [CWE-862] and is fixed in versions 15.111.0 and 16.22.0.

Critical Impact
Authenticated low-privilege users can dispatch automated customer statement-of-accounts emails without holding the required role, breaking segregation-of-duties controls in accounting workflows.

Affected Products

ERPNext versions prior to 15.111.0
ERPNext versions prior to 16.22.0
Frappe/ERPNext Process Statement Of Accounts module

Discovery Timeline

2026-08-10 - CVE-2026-72906 published to NVD
2026-08-11 - Last updated in NVD database
2026-08-10 - GitHub Security Advisory GHSA-3x6c-gc4v-f5v8 published
Patch releases - ERPNext v15.111.0 and ERPNext v16.22.0

Technical Details for CVE-2026-72906

Vulnerability Analysis

The Process Statement Of Accounts feature in ERPNext automates emailing account statements to customers on a schedule. The send_auto_email server-side function iterates configured recipients and dispatches templated PDF statements. Before the fix, this function did not verify that the calling user held the Process Statement Of Accounts permission. An authenticated user with only baseline access could invoke the code path and cause emails to be sent using the platform's outbound mail infrastructure.

The vulnerability is Missing Authorization [CWE-862]. It does not expose confidentiality or availability, but it enables unauthorized modification of outbound communications state. Attackers with valid low-privilege credentials can send business communications on behalf of the organization, tamper with accounting workflows, or spam customers.

Root Cause

The send_auto_email function in process_statement_of_accounts.py executed permission-sensitive logic without invoking a role or DocType permission check. The upstream fix adds template validation for pdf_name alongside a permission enforcement path, ensuring only users with the Process Statement Of Accounts permission can trigger auto-emails.

Attack Vector

Exploitation requires network access to the ERPNext application and a valid authenticated session with any low-privilege role. No user interaction is required. The attacker calls the send_auto_email server endpoint directly, bypassing the intended role check and causing statement-of-account emails to be generated and sent.

python

// Patch excerpt: process_statement_of_accounts.py
 		validate_template(self.subject)
 		validate_template(self.body)
+		validate_template(self.pdf_name)
 
 		if not self.customers:
 			frappe.throw(_("Customers not selected."))

Source: GitHub Commit 18ca96c36ba6 and GitHub Commit e15879acd118. The patch validates the pdf_name template and adds the missing Process Statement Of Accounts permission check to send_auto_email.

Detection Methods for CVE-2026-72906

Indicators of Compromise

Unexpected outbound emails originating from the Process Statement Of Accounts workflow at non-scheduled times.
Frappe audit log entries showing send_auto_email calls initiated by users lacking the Process Statement Of Accounts role.
Customer complaints about statement emails received outside normal billing cycles.

Detection Strategies

Review Frappe application logs and the Communication DocType for statement-of-accounts emails correlated with the user who triggered them.
Compare the sending user's assigned roles against the Process Statement Of Accounts permission list to identify unauthorized triggers.
Alert on high-volume or off-schedule invocations of the send_auto_email endpoint.

Monitoring Recommendations

Enable and forward ERPNext access logs to a centralized log platform for correlation and retention.
Monitor the outbound SMTP relay for spikes in statement-of-accounts messages attributable to the ERPNext service account.
Track ERPNext version strings across deployments to confirm patched builds are in production.

How to Mitigate CVE-2026-72906

Immediate Actions Required

Upgrade ERPNext to 15.111.0 or 16.22.0 or later without delay.
Audit user role assignments and remove Process Statement Of Accounts capability from accounts that should not send customer communications.
Review outbound email logs since the last upgrade for evidence of unauthorized statement-of-accounts dispatches.

Patch Information

The fix is delivered in ERPNext v15.111.0 and ERPNext v16.22.0. The change is tracked in Pull Request #55781 and applied via commits 18ca96c36ba6 and e15879acd118. Full details are in GHSA-3x6c-gc4v-f5v8.

Workarounds

Restrict network access to the ERPNext instance to trusted users while patching is scheduled.
Temporarily disable Process Statement Of Accounts auto-email schedulers via the DocType configuration until the upgrade is complete.
Rotate any low-privilege credentials suspected of being shared or exposed to reduce the pool of accounts able to invoke the endpoint.

bash

# Upgrade ERPNext on a bench-managed deployment
bench update --patch
bench switch-to-branch version-15 erpnext --upgrade   # or version-16
bench get-app --branch version-15 erpnext             # ensure >= 15.111.0
bench --site <sitename> migrate
bench restart