CVE-2026-72910

Name of the Vulnerable Software and Affected Versions ERPNext versions prior to 15.112.0 ERPNext versions prior to 16.22.0

Description Authenticated users with limited privileges can modify protected data beyond their assigned roles because certain functions omit required write permission checks. The affected functions include merge account(), pause job for doc(), trigger job for doc(), change release date(), and update cost center(), located within the files erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process payment reconciliation/process payment reconciliation.py, erpnext/accounts/doctype/purchase invoice/purchase invoice.py, and erpnext/accounts/utils.py.

Recommendations Update to version 15.112.0. Update to version 16.22.0.