ERP: Document access through endpoints due to missing validation
Priority MEDIUM 48CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed erpnext (frappe): 16.6.1, 15.98.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| frappe | erpnext | 16.0.0-rc.1 to before 16.6.1; before 15.98.1 | 16.6.1, 15.98.1 | Patch available | CNA |
- erpnext Vendorfrappe Affected 16.0.0-rc.1 to before 16.6.1; before 15.98.1 Fixed in 16.6.1, 15.98.1 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* | before 15.98.1; after 16.0.0, before 16.6.1 | Vulnerable | frappe |
| cpe:2.3:a:frappe:erpnext:16.0.0:-:*:*:*:*:*:* | 16.0.0 | Vulnerable | frappe |
| cpe:2.3:a:frappe:erpnext:16.0.0:rc1:*:*:*:*:*:* | 16.0.0 rc1 | Vulnerable | frappe |
| cpe:2.3:a:frappe:erpnext:16.0.0:rc2:*:*:*:*:*:* | 16.0.0 rc2 | Vulnerable | frappe |
- cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:* Versions before 15.98.1; after 16.0.0, before 16.6.1 Vulnerable ·frappe
- cpe:2.3:a:frappe:erpnext:16.0.0:-:*:*:*:*:*:* Versions 16.0.0 Vulnerable ·frappe
- cpe:2.3:a:frappe:erpnext:16.0.0:rc1:*:*:*:*:*:* Versions 16.0.0 rc1 Vulnerable ·frappe
- cpe:2.3:a:frappe:erpnext:16.0.0:rc2:*:*:*:*:*:* Versions 16.0.0 rc2 Vulnerable ·frappe
Remediation
- Fix · CNA erpnext (frappe) Fixed in 16.6.1, 15.98.1
Timeline
- 2026-10-02 Threatist record created from CVE-2026-27471
References
More frappe Erpnext vulnerabilities
- TI-2026-28140 ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). CVSS 3.1CRITICAL 9.8
- TI-2025-40873 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
- TI-2025-40872 An issue was discovered in Frappe ERPNext through 15.89.0. CVSS 3.1CRITICAL 9.8
- TI-2025-40871 A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext… CVSS 3.1CRITICAL 9.8
- TI-2025-32462 In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at… CVSS 3.1HIGH 8.2
- TI-2025-32461 In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at… CVSS 3.1HIGH 8.2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences