ERPNext CVE-2026-72908

Exploitation requires a valid authenticated session with at least low-privilege access to ERPNext - any user role that can initiate or view sales orders, purchase orders, or other transaction types that trigger tax template resolution is sufficient. No administrator privileges, no special configuration, and no non-default feature enablement are required beyond basic authenticated access. Exploitation is limited by the authentication requirement: unauthenticated external attackers cannot reach the vulnerable function. The CVSS vector PR:L confirms this: low-privilege authentication is necessary but the barrier is low in any multi-user ERPNext deployment. There is no indication that specific modules must be enabled beyond standard accounts and tax rule configuration, which is present in virtually all ERPNext installations.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N accurately reflects the exploitation profile: network-reachable, low attack complexity, requiring only low-privilege authentication, with high confidentiality impact and no integrity or availability impact. No EPSS score was provided in the source data, so probability-of-exploitation estimates cannot be quantified beyond qualitative assessment. No CISA KEV listing and no public exploit code have been identified, which meaningfully reduces the immediacy of opportunistic mass exploitation compared to what the CVSS score alone might imply. However, the low privilege requirement - any authenticated ERP user with access to transactional workflows can trigger the vulnerable function - substantially widens the attacker population in multi-tenant or shared ERPNext deployments. Integrity and availability impacts are absent from the CVSS vector, meaning confirmed exploitation is limited to data exfiltration rather than data manipulation or denial of service, though secondary chained attacks using extracted credentials are plausible. Given that ERPNext installations routinely store financial records, supplier data, employee information, and customer PII, the confidentiality impact in practice is high-value. The combination of low-complexity exploitation and high-value data targets makes this a genuine remediation priority for any organization running unpatched versions, despite the absence of confirmed in-the-wild exploitation.

An attacker with any valid ERPNext account - including a minimal-privilege role such as a sales user or purchase user - crafts a request to a transaction endpoint that invokes get_tax_template, injecting a SQL fragment into the posting_date or a transaction argument field. The injected payload appends a UNION SELECT or boolean-based blind condition that extracts data from sensitive tables such as tabUser, tabEmployee, or tabBank Account. No public exploit code has been identified, but the vulnerability class and the publicly visible PR diff provide sufficient technical detail for a skilled attacker to independently develop an exploit.