Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-27471

ERP: Document access through endpoints due to missing validation

Description

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

frappe erpnext

  • >= 16.0.0-rc.1, < 16.6.1affected
  • < 15.98.1affected

References