CVE-2026-27471 is a critical (CVSS 9.1) access control flaw in ERPNext. Certain endpoints lacked access validation, so unauthorized users could read documents they should not see. Versions up to 15.98.0, and 16.0.0 release candidate 1 through 16.6.0, are affected. Upgrade to 15.98.1 or 16.6.1.
What's affected
ERPNext versions up to 15.98.0, and 16.0.0-rc.1 through 16.6.0. The fixes are 15.98.1 and 16.6.1.
How to check if you're exposed
bench version
Compare the erpnext line with the fixed versions. Then consider what an unauthorized reader could have seen: ERPNext holds invoices, payroll, stock and customer records. Check access logs for endpoints called by users who should not see those documents.
What to do now
- Upgrade ERPNext to 15.98.1 on the 15 line or 16.6.1 on the 16 line.
- Run bench update, or your normal upgrade process, on every site and bench.
- Review access logs for odd document reads by users with low privileges.
- Review role permissions and remove ones you do not need.
- If sensitive data may have been read, involve your data protection owner.
Why it matters
The record lists CWE-862 (missing authorization), CWE-306 (missing authentication) and CWE-284 (improper access control). Endpoints returned documents without first checking whether the caller was allowed to see them.
This flaw reads data, not code. For an ERP system that is still serious, because the data is financial and personal. The record does not mark this CVE as known exploited.
Quick check
Which versions fix it?
15.98.1 and 16.6.1, according to the record.
Sources
- CVE-2026-27471 on Gold
- GitHub advisory listed in the record: https://github.com/frappe/erpnext/security/advisories/GHSA-wpfx-jw7g-7f83
- Fix commit listed in the record: https://github.com/frappe/erpnext/commit/78fc9424d9085c2eafe1211931e22d7044f85fc7
Last reviewed: 19 October 2026.
