Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py lacks a Process Statement Of Accounts permission check, allowing an authenticated low-privilege user to trigger automated emails outside the permitted role. This issue is fixed in versions 15.111.0 and 16.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-10T21:17:25.320Z",
  "pubdate": "2026-08-10T21:17:25.320Z",
  "executiveSummary": "An authorization bypass vulnerability exists within ERPNext prior to versions 15.111.0 and 16.22.0, specifically located in the send_auto_email function within erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py. This security defect stems from a complete lack of proper Process Statement Of Accounts permission checks prior to executing core functional logic. Consequently, an authenticated low-privilege user can successfully invoke the vulnerable function to trigger and dispatch automated emails outside of their authorized roles and assigned privileges. The risk implications include unauthorized communications, potential information disclosure via statements of accounts, and abuse of notification mechanisms. Exploitation of this vulnerability requires authentication within the application, but does not necessitate elevated administrative privileges, allowing malicious or compromised low-privilege accounts to perform unauthorized actions. Remediation requires updating ERPNext to version 15.111.0, version 16.22.0, or later, where the appropriate access control checks have been integrated into the function.",
  "technicalDetails": "The vulnerability resides in the ERPNext accounting module, specifically within the erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py file, inside the send_auto_email function. The root cause of the security flaw is an inadequate implementation of access control enforcement; the application fails to validate whether the interacting authenticated user possesses the required Process Statement Of Accounts permissions before initiating the automated email dispatch sequence.\nThe attack flow proceeds as follows: an attacker with standard authenticated access and low privileges interacts with the ERPNext instance. By targeting the unprotected send_auto_email function through direct function calls or API endpoints exposed by the framework, the user bypasses standard role-based access control (RBAC) validations. Upon receiving the execution request, the vulnerable function processes the underlying logic without verifying user authorization context and proceeds to generate and transmit automated statements of accounts via email to designated recipients.\nThe affected components are versions of ERPNext prior to 15.111.0 and 16.22.0. The authentication requirement is authenticated access, but privilege requirements are limited to low-privilege users who otherwise lack the administrative or specific functional roles necessary to execute the Process Statement Of Accounts workflow. The network exposure corresponds to the standard web application interface exposed by ERPNext. The post-exploitation impact includes unauthorized data dissemination, where sensitive financial statements or account summaries are sent to external or internal recipients contrary to organizational policy, as well as potential denial of service or spamming capabilities through the abuse of automated mail delivery systems."
}