CVE-2026-27471

ERP: Document access through endpoints due to missing validation

State: Published
Severity: 9.3 Critical
Published: Feb 21, 2026
Updated: Feb 24, 2026
Reserved: Feb 19, 2026

Description

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-862 Missing Authorization
CWE-306 Missing Authentication for Critical Function
CWE-284 Improper Access Control

Affected Products

Product	Versions
erpnextfrappe	>= 16.0.0-rc.1, < 16.6.1Affected < 15.98.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.