Description

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-10T21:17:25.860Z",
  "pubdate": "2026-08-10T21:17:25.860Z",
  "executiveSummary": "An authorization bypass vulnerability exists within ERPNext prior to versions 15.112.0 and 16.22.0. The vulnerability stems from the omission of required write permission checks across multiple sensitive functions within the application backend. This security defect allows authenticated users with limited privileges to execute unauthorized modifications of protected data, bypassing role-based access control mechanisms.\nThe impact of this vulnerability includes unauthorized data alteration and manipulation of critical financial, accounting, and operational workflows. The affected product is ERPNext, specifically impacting deployments running versions prior to 15.112.0 and 16.22.0. The risk implications are severe, as malicious actors or compromised low-privilege accounts can manipulate sensitive ledger data, modify release dates, and alter cost centers or payment reconciliation processes without possessing the requisite administrative roles.\nExploitation of this vulnerability requires authentication within the application, but does not necessitate elevated privileges or specialized administrative roles beyond standard authenticated access. Attackers leverage the missing access control checks to directly invoke the vulnerable backend functions, resulting in unauthorized state changes across enterprise resource planning data structures.",
  "technicalDetails": "The vulnerability is caused by a failure to enforce proper access control validations, specifically the omission of required write permission checks, within several backend methods across multiple modules in ERPNext. The vulnerable components include the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions.\nThese vulnerable functions reside in specific source files within the codebase: erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py. Affected versions include all instances of ERPNext prior to 15.112.0 and 16.22.0.\nRegarding authentication and privilege requirements, the attack requires the user to be authenticated within the application. However, because the vulnerable functions fail to validate whether the calling user possesses appropriate write permissions or administrative roles, limited users can successfully execute these routines.\nThe attack flow proceeds as follows: An authenticated attacker with limited privileges identifies the backend endpoints or remote procedure call interfaces mapped to the vulnerable functions. The attacker crafts an arbitrary request targeting functions such as merge_account or update_cost_center. Upon receiving the request, the application executes the underlying logic without performing authorization checks to verify if the user is authorized to write to or modify the targeted documents or database entities. Consequently, the backend processes the request and commits unauthorized modifications to protected ERP records, such as financial accounts, purchase invoices, and cost centers.\nPost-exploitation impact encompasses the corruption of financial data, disruption of business processes, manipulation of payment reconciliation workflows, and unauthorized alteration of accounting records. This breaks the integrity of the enterprise resource planning data and undermines compliance and internal financial controls."
}