Unauthorized Document Access in ERPNext Affected by Frappe Technologies
CVE-2026-27471

9.3CRITICAL

Key Information:

Vendor

Frappe

Status
Erpnext
Vendor
CVE Published:
21 February 2026

What is CVE-2026-27471?

The ERPNext platform, developed by Frappe Technologies, is vulnerable due to improper access validation in certain endpoints, permitting unauthorized users to gain access to sensitive documents. This flaw impacts versions up to 15.98.0 and 16.0.0-rc.1, and has been resolved in the subsequent releases 15.98.1 and 16.6.1. Users are strongly advised to upgrade promptly to mitigate potential data breaches.

Affected Version(s)

erpnext >= 16.0.0-rc.1, < 16.6.1 < 16.0.0-rc.1, 16.6.1

erpnext < 15.98.1 < 15.98.1

References

https://github.com/frappe/erpnext/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/frappe/erpnext/commit/78fc9424d9085c2e...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.