CVE-2026-72907: ERPNext Auth Bypass Vulnerability

CVE-2026-72907 Overview

CVE-2026-72907 is an improper authorization vulnerability [CWE-285] in ERPNext, the open source Enterprise Resource Planning platform built on the Frappe framework. The flaw resides in the add_ac function within erpnext/accounts/utils.py. The function accepts an ignore_permissions argument from user input without enforcing the Account create permission. An authenticated user with limited privileges can leverage this to create unauthorized accounting master records, compromising financial data integrity and audit trails. The issue affects ERPNext versions prior to 15.111.0 and 16.22.0 and is fixed in those releases.

Critical Impact
Authenticated low-privileged users can bypass permission checks to create arbitrary Account records in the ERP chart of accounts, corrupting financial data and audit trails.

Affected Products

ERPNext versions prior to 15.111.0
ERPNext versions prior to 16.22.0
Deployments using the add_ac function in erpnext/accounts/utils.py

Discovery Timeline

2026-08-10 - CVE-2026-72907 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-72907

Vulnerability Analysis

The add_ac function is responsible for creating new Account doctype records in ERPNext's chart of accounts. Prior to the patch, the function inspected args.get("ignore_permissions") from the request payload and, if truthy, set ac.flags.ignore_permissions = True on the new document. This directly disables Frappe's permission enforcement for the document write.

Because args is populated from frappe.local.form_dict, any authenticated caller reaching this endpoint could submit ignore_permissions=1 alongside account fields. The framework would then create the record regardless of whether the caller held the Account create permission. The vulnerability provides no additional confidentiality impact, but integrity impact is high because attackers can inject arbitrary account hierarchy entries that participate in ledger postings and financial reports.

Root Cause

The root cause is trust of a client-controlled flag inside a privileged server routine. The add_ac function honored ignore_permissions without validating that the calling user was authorized to bypass access controls. Combined with the absence of an explicit frappe.has_permission("Account", "create") check, this produced a permission bypass reachable by any authenticated session.

Attack Vector

The attack is network-reachable and requires only low privileges. An authenticated user submits a request to the account creation endpoint including the ignore_permissions argument set to true. The server-side handler passes the flag through to the document layer, which suppresses permission enforcement and writes the record.

python

# Security patch in erpnext/accounts/utils.py (add_ac function)
# Source: https://github.com/frappe/erpnext/commit/2d0e3fd9af521e407be35fd09e9427176609513f

 	if not args:
 		args = frappe.local.form_dict
 
+	args.pop("ignore_permissions", None)
+	frappe.has_permission("Account", "create", throw=True)
+
 	args.doctype = "Account"
 	args = make_tree_args(**args)
 
 	ac = frappe.new_doc("Account")
-
-	if args.get("ignore_permissions"):
-		ac.flags.ignore_permissions = True
-		args.pop("ignore_permissions")
-
 	ac.update(args)
 
 	if not ac.parent_account:

The fix strips ignore_permissions from the incoming arguments and explicitly calls frappe.has_permission("Account", "create", throw=True) before instantiating the document.

Detection Methods for CVE-2026-72907

Indicators of Compromise

Unexpected Account doctype records created by users who lack the Accounts Manager or equivalent role.
HTTP requests to ERPNext endpoints invoking erpnext.accounts.utils.add_ac containing an ignore_permissions parameter.
Frappe audit log entries showing account creation with flags.ignore_permissions = True attributed to non-privileged users.
Unexplained additions or modifications to the chart of accounts outside change-control windows.

Detection Strategies

Review the Frappe Activity Log and Version doctype records for Account creations, correlating creator role with expected permissions.
Inspect application access logs for POST requests carrying cmd=erpnext.accounts.utils.add_ac combined with ignore_permissions in the body.
Compare the current chart of accounts against a known-good baseline to identify unauthorized master data changes.

Monitoring Recommendations

Enable detailed request logging on the ERPNext web server and forward logs to a centralized analytics platform for query on parameter names.
Alert on any occurrence of the string ignore_permissions in inbound request bodies to accounting endpoints.
Monitor role assignments and privilege changes on the Account doctype to detect follow-on persistence activity.

How to Mitigate CVE-2026-72907

Immediate Actions Required

Upgrade ERPNext to version 15.111.0 or 16.22.0 or later without delay.
Audit all Account records created since the deployment of a vulnerable version and reconcile against authorized change requests.
Restrict which roles are granted the Accounts User and higher permissions until patching is complete.
Rotate API keys for any accounts that could have reached the vulnerable endpoint if abuse is suspected.

Patch Information

The upstream fix is delivered in ERPNext v15.111.0 and ERPNext v16.22.0. Technical details are documented in GitHub Security Advisory GHSA-94v6-784v-24q5 and the associated pull request discussion. The corrective commits remove client-controlled ignore_permissions handling and add an explicit frappe.has_permission check.

Workarounds

If immediate upgrade is not feasible, apply a local patch that strips ignore_permissions from frappe.local.form_dict and calls frappe.has_permission("Account", "create", throw=True) inside add_ac.
Place a reverse proxy or WAF rule that rejects requests to erpnext.accounts.utils.add_ac containing the ignore_permissions field.
Temporarily revoke the Account create permission from non-administrative roles until the patched version is deployed.

bash

# Upgrade ERPNext using the bench command line tool
bench switch-to-branch version-15 erpnext --upgrade
bench update --reset
bench version | grep erpnext   # Confirm 15.111.0 or later

# For version 16 deployments
bench switch-to-branch version-16 erpnext --upgrade
bench update --reset
bench version | grep erpnext   # Confirm 16.22.0 or later