CVE-2026-27471 CRITICAL

CVE-2026-27471: ERP: Document access through endpoints due to missing validation

Vendor Frappe
Product erpnext
Weakness CWE-862 · Missing authorization
Published February 21, 2026
Last update February 24, 2026
View on NVD All CVEs

CVSS base score

9.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

Key dates

02Disclosure timeline

February 21, 2026 CVE published
February 24, 2026 Record updated