PT-2026-21361 · Erp · Erp

Arthurgervais + 1 · Published 2026-02-21 · Updated 2026-02-24 · CVE-2026-27471

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ERP versions up to 15.98.0 ERP versions 16.0.0-rc.1 through 16.6.0

Description Certain API endpoints in ERP lacked proper access validation, potentially allowing unauthorized access to documents. The issue affects versions up to 15.98.0 and 16.0.0-rc.1 through 16.6.0. The lack of authorization on APIs could allow unauthenticated attackers to access sensitive documents.

Recommendations Update to version 15.98.1 or later. Update to version 16.6.1 or later.

Exploit

Fix

Missing Authorization

Improper Access Control

Missing Authentication

Weakness Enumeration

CWE-862

CWE-284

CWE-306

Related Identifiers

CVE-2026-27471

GHSA-WPFX-JW7G-7F83

Affected Products

Erp

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27471.json · Exploit
• https://github.com/frappe/erpnext/security/advisories/GHSA-wpfx-jw7g-7f83 · Vendor Advisory
• https://github.com/frappe/erpnext/commit/78fc9424d9085c2eafe1211931e22d7044f85fc7 · Patch
• https://osv.dev/vulnerability/CVE-2026-27471 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27471 · Security Note
• https://twitter.com/CCBalert/status/2025941004826607806 · Twitter Post
• https://twitter.com/HatforceSec/status/2026426173413093886 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025119180412883299 · Twitter Post
• https://twitter.com/TheHackerWire/status/2026351652312330598 · Twitter Post
• https://twitter.com/offseq/status/2025133427171655992 · Twitter Post
• https://twitter.com/CVEnew/status/2025154180080419308 · Twitter Post
• https://t.me/CVEtracker/45360 · Telegram Post
• https://twitter.com/Zaddyzaddy/status/2026428775324430624 · Twitter Post