CyberRota Analysis
AI-GeneratedThe send_auto_email function in ERPNext versions prior to 15.111.0 and 16.22.0 is vulnerable due to a missing permission check, allowing low-privilege authenticated users to send automated emails without proper authorization. This could lead to unauthorized disclosure of information or spam, impacting the integrity of communications within the organization. Organizations using affected versions should prioritize upgrading to the patched versions to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.