CVE-2026-72906

4.3 Moyenne

Publiée le 10/08/2026 à 23:17 · Modifiée le 23/10/2026 à 21:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.

Traduire en français

Produits concernés

frappe erpnext

Scores CVSS

Version	Score	Source	Vecteur
3.1	4.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N`

Faiblesses (CWE)

CWE-862

Références

https://github.com/frappe/erpnext/commit/18ca96c36ba65362bf1c25abb8eab32c64c6c7dd
https://github.com/frappe/erpnext/commit/e15879acd118ccd343e31ad3b5a6279e514c82c2
https://github.com/frappe/erpnext/pull/55781
https://github.com/frappe/erpnext/releases/tag/v15.111.0
https://github.com/frappe/erpnext/releases/tag/v16.22.0
https://github.com/frappe/erpnext/security/advisories/GHSA-3x6c-gc4v-f5v8

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories