CVE-2026-72907 ERPNext: Broken Access Control on certain endpoint

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the addac function in erpnext/accounts/utils.py accepts the ignorepermissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized...

CVE-2026-72907

ERPNext contains a broken access control vulnerability in add_ac in erpnext/accounts/utils.py prior to versions 15.111.0 and 16.22.0, where ignore_permissions is not enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and co...