CVE-2026-72909

ERPNext vulnerability CVE-2026-72909 affects the ReceivablePayableReport path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py. The issue is that the prepare_conditions logic fails to apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party ...