ERPNext CVE-2026-72911

Exploitation requires an authenticated ERPNext account with a common operational role that can create or edit Process Statement of Accounts records - the attacker must be able to write into the subject, body, or pdf_name fields of that specific doctype. Code executes when those fields are rendered, i.e. at document validation and when send_emails generates the statement, so the attacker needs the record to be validated/processed (which the standard statement workflow performs). Limiting factors: valid low-privilege credentials are mandatory (PR:L, so not remote-unauthenticated), and exploitation is confined to instances where users with access to this feature exist; the vulnerable pre-restrict_globals code path is present only in versions before 15.118.0 / 16.29.0. No user interaction from a victim and no non-default configuration is required.

All signals point to a genuine high priority rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes network-reachable, low-complexity, no-user-interaction exploitation requiring only low privileges (PR:L) - consistent with the description's 'authenticated user with a common operational role.' The scope change (S:C) reflects that template code execution escapes the document context into the underlying server/application. SSTI leading to code execution is inherently reliable to weaponize, aligning with the RCE/SSTI tags. No EPSS score, KEV entry, or public POC was provided, so real-world exploitation is unconfirmed; the absence of KEV plus a fresh patch suggests no confirmed active exploitation yet, but the low bar to exploit warrants urgent remediation. The only meaningful barrier is that an attacker must first hold a valid low-privilege account with access to the Process Statement of Accounts doctype.

An attacker holding a routine ERPNext operational account opens a Process Statement of Accounts record and enters a malicious Jinja expression (e.g., referencing frappe.utils) into the subject, body, or pdf_name field. When the record is validated or the statement email is generated and sent, the template engine evaluates the expression with unrestricted globals, executing the attacker's code on the ERPNext server. No public POC was provided, but SSTI of this form is straightforward to weaponize given AV:N/AC:L and no required user interaction.