CVE-2026-27471: ERP: Document access through endpoints due to missing validation

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-21 · updated 2026-06-17
Weakness: CWE-284

Description

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

Affected products

frappe erpnext: before 15.98.1; from 16.0.0 (excl.) before 16.6.1; 16.0.0, 16.0.0-rc1, 16.0.0-rc2 — fixed in 15.98.1, 16.6.1

How to fix

Upgrade to a fixed version: frappe erpnext 15.98.1, 16.6.1. Check the vendor advisory for mitigations.

References

https://github.com/frappe/erpnext/commit/78fc9424d9085c2eafe1211931e22d7044f85fc7
https://github.com/frappe/erpnext/security/advisories/GHSA-wpfx-jw7g-7f83

Get alerted when CVE-2026-27471 or the next vulnerability affects your stack