Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the add_ac function in erpnext/accounts/utils.py accepts the ignore_permissions argument without enforcing Account create permission, allowing an authenticated limited user to create unauthorized accounting master records and affect financial data integrity and audit trails. This issue is fixed in versions 15.111.0 and 16.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T21:17:25.460Z",
  "pubdate": "2026-08-10T21:17:25.460Z",
  "executiveSummary": "An authorization bypass vulnerability exists in ERPNext prior to versions 15.111.0 and 16.22.0 within the accounting utilities. The flaw allows authenticated users with limited privileges to supply the ignore_permissions argument to the add_ac function, bypassing mandatory Account create permission validations. This capability enables unauthorized actors to inject and create arbitrary accounting master records directly within the system. The primary security impact encompasses the corruption of financial data integrity, degradation of internal audit trails, and unauthorized manipulation of core accounting structures. Exploitation of this vulnerability requires authenticated access to the application, but it does not demand elevated administrative privileges. Risk implications are substantial for organizations relying on strict segregation of duties and granular access controls within their enterprise resource planning environment, as malicious or inadvertent record creation can compromise financial reporting accuracy.",
  "technicalDetails": "The root cause of this vulnerability lies in inadequate parameter handling and missing access control enforcement within the accounting utility module of ERPNext. Specifically, the vulnerable function add_ac located in erpnext/accounts/utils.py accepts the ignore_permissions argument without properly validating whether the executing session possesses the requisite Account create permissions. When an authenticated user with limited privileges invokes operations that route through this function, passing the ignore_permissions parameter allows the underlying logic to bypass standard permission checks enforced by the framework's Object Relational Mapping (ORM) and access control layers.\nThe attack flow begins when an authenticated attacker with low-level privileges interacts with application interfaces or API endpoints that invoke the add_ac function. By supplying or manipulating the request payload to include the ignore_permissions flag, the attacker forces the application backend to execute the database transaction and record insertion without verifying authorization constraints against the user's assigned roles. The vulnerable component is the add_ac function inside erpnext/accounts/utils.py. Affected software versions include all instances of ERPNext prior to 15.111.0 and 16.22.0.\nThe exploitation method relies strictly on logical flaws in permission validation rather than memory corruption or injection vectors. The attacker requires standard user authentication within the ERPNext application, meaning anonymous or unauthenticated network exposure is insufficient for direct exploitation. However, once authentication is established, the attacker can leverage this privilege escalation flaw to instantiate unauthorized accounting master records. The post-exploitation impact includes severe financial data integrity violations, unauthorized tampering with chart of accounts structures, and distortion of system audit trails, complicating compliance monitoring and forensic investigations."
}