AUGUST 15, 2026
Live Feed
Back to database
Case File

CVE-2026-72907

MEDIUM · CVSS 6.5 EPSS 0.25% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-15

CyberRota Analysis

AI-Generated

The add_ac function in ERPNext's accounts utility allows authenticated limited users to bypass account creation permissions due to improper handling of the ignore_permissions argument, potentially leading to unauthorized creation of accounting master records. This vulnerability can compromise financial data integrity and disrupt audit trails. Organizations using affected versions should prioritize upgrading to versions 15.111.0 or 16.22.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-72907
Severity
MEDIUM
CVSS
6.5
EPSS
0.25%

Original NVD Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.