ERPNext week 32 2026 advisories: critical server-side template injection (CVE-2026-72911) and access-control flaws

What happened

The most serious issue, CVE-2026-72911, is a server-side template injection in the Process Statement of Accounts module. An attacker with a common operational role and network access can supply template expressions in the subject, body, and pdf_name fields because the validate_template and render_template calls expose unrestricted globals, including frappe.utils. That allows execution of arbitrary server-side code and reading data across the ERPNext application. The CVSS 3.1 score is 9.9, with low privileges and no user interaction.

Several other ERPNext flaws are authorization and validation gaps. CVE-2026-72909 lets an authenticated user read cross-company financial data in Accounts Receivable and Accounts Payable reports. CVE-2026-72910 lets a limited user modify protected data through account and reconciliation functions that lack write permission checks. CVE-2026-13227 exposes Prospect opportunity data through a whitelisted API method. CVE-2026-72906 lets a low-privileged user trigger automated emails outside the permitted role.

In the Frappe framework, CVE-2026-49391 is a stored cross-site scripting issue in Data Import: imported column headers are not escaped before previews and results, so script executes when another user views the import interface. CVE-2026-53569 is a missing authorization issue in the toggle_like and mark_as_seen endpoints, with no released fixed version as of this review. None of these entries is listed in CISA KEV, and the CVE records do not report public exploitation.

Who is affected

ERPNext deployments are affected as follows: CVE-2026-72911 affects versions before 15.118.0 and from 16.0.0 to before 16.29.0. CVE-2026-13227 affects before 15.115.0 and before 16.26.0. CVE-2026-72909 affects before 15.112.0 and from 16.0.0 to before 16.23.0. CVE-2026-72910 affects before 15.112.0 and from 16.0.0 to before 16.22.0. CVE-2026-72906 affects before 15.111.0 and from 16.0.0 to before 16.22.0.

Frappe framework deployments: CVE-2026-53569 affects up to and including 16.31.0. CVE-2026-49391 affects before 15.109.0 and from 16.0.0-beta.1 to before 16.19.0. ERPNext and Frappe are usually self-hosted systems holding financial, customer, and employee data.

What to do now

1. Upgrade ERPNext to the fixed release for your branch. For CVE-2026-72911, the fixes are 15.118.0 and 16.29.0. The other ERPNext flaws are fixed in 15.115.0 and 16.26.0 (CVE-2026-13227), 15.112.0 and 16.23.0 (CVE-2026-72909), 15.112.0 and 16.22.0 (CVE-2026-72910), and 15.111.0 and 16.22.0 (CVE-2026-72906). If you cannot move to 15.118.0 or 16.29.0, apply the issue-specific release.
2. Upgrade Frappe to 15.109.0 or 16.19.0 to resolve CVE-2026-49391.
3. For CVE-2026-53569, no fixed release is available as of this review and no workaround has been published. Restrict access to the affected whitelisted desk endpoints to trusted users and monitor for unexpected changes to note seen state or _liked_by metadata until a fix is published.
4. After patching, re-check roles and permissions around accounts, CRM, and data import, because several issues stem from missing authorization and validation checks.

Beyond the patch

ERPNext runs core financial and customer processes, so a missed patch can expose cross-company data and automated business workflows. This cluster shows why tracking third-party and open-source components by version and patch cadence matters: your exposure window is set by how quickly you notice and apply upstream releases. Supply Chain Defense & Third-Party Risk helps keep that inventory and patch cycle visible. If you suspect an authenticated account has already been abused, Incident Response Retainer provides the response support to contain and investigate.