CVE-2026-72906
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
ERPNext prior to versions 15.111.0 and 16.22.0 has a vulnerability in the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py that lacks a Process Statement Of Accounts permission check. An authenticated low-privilege user can trigger automated emails outside the permitted role.
Risk Assessment
Risk of sending unauthorized emails, which could lead to confidentiality breaches or use for phishing.
Recommendation
Upgrade ERPNext to version 15.111.0 or 16.22.0 where this vulnerability is fixed. Restrict user permissions and monitor email sending.
Original NVD description (English source)
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.