CVE-2026-72909 frappe CVE debrief

Who should care

Defenders responsible for ERPNext deployments, especially those with multiple companies and users with different roles, should assess exposure and verify that the fix is applied. They should prioritize verifying exposure, reviewing user permissions, and monitoring reports to prevent unauthorized access to financial data.

Why it matters

CVE-2026-72909 allows authenticated users to access unauthorized cross-company financial data in ERPNext deployments. Defenders should prioritize verifying exposure, reviewing user permissions, and monitoring reports.

• Verify ERPNext version to prevent unauthorized access to financial data
• Review user permissions and roles to ensure proper access controls
• Monitor Accounts Receivable and Accounts Payable reports for potential data exposure

Technical summary

The ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field. This allows any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. The issue is fixed in versions 15.112.0 and 16.23.0. The vulnerability impacts ERPNext deployments, especially those with multiple companies and users with different roles.

Defensive priority

Defenders should prioritize verifying exposure in ERPNext deployments, especially those with multiple companies and users with different roles.

Recommended defensive actions

• Verify ERPNext version to ensure it is 15.112.0 or 16.23.0 or later
• Review user permissions and roles in ERPNext deployments
• Monitor Accounts Receivable and Accounts Payable reports for unauthorized access
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability in ERPNext, a free and open-source Enterprise Resource Planning tool. The ReceivablePayableReport prepare_conditions path in erpnext/accounts/report/accounts_receivable/accounts_receivable.py does not apply Customer and Supplier user permissions to the Payment Ledger Entry dynamic-link party field. This allows any authenticated user to read unauthorized cross-company financial data in Accounts Receivable and Accounts Payable reports. The issue is fixed in versions 15

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.