CVE-2026-27471CWE-284CWE-306CWE-862

ERP: Document access through endpoints due to missing validation

Critical · published February 21, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
41.2
In the wild
Unconfirmed
What it is

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00488 · 41.2th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-306 · Missing Authentication for Critical Function; CWE-862 · Missing Authorization
Published
2026-02-21T06:38Z
EPSS history
Timeline
  • 21 FEB 06:38Z
    ERP: Document access through endpoints due to missing validation
    cvelistv5