CVE-2026-27471

Product: ERPNext (Open Source ERP Tool)
Vulnerability Type: Access Control Bypass / Unauthorized Document Access
Attack Vector: Remote (Network)
Authentication Required: No (in vulnerable endpoints)
User Interaction: Not required
Severity: Critical
CVSS Score: 9.3 (Critical)
Exploitability: High (Low complexity, remotely accessible)
Exploit Availability: No confirmed public exploit at the time of disclosure; however, exploitation is technically straightforward due to missing permission validation logic.
Impact: Confidentiality – High | Integrity – High | Availability – Low

Official Patch / Upgrade Link:
https://github.com/frappe/erpnext/security/advisories/GHSA-wpfx-jw7g-7f83

Overview

CVE-2026-27471 is a critical access control vulnerability affecting ERPNext. The issue was caused by missing authorization validation in specific API endpoints. Certain methods exposed via /api/method/ were callable without proper permission checks, allowing unauthorized users to retrieve internal ERP documents.

The vulnerability does not require authentication if the affected endpoint allows guest access. By directly invoking backend functions and passing crafted parameters, internal business documents could be accessed without having the required role or privileges.

The issue has been resolved in patched versions by enforcing explicit permission validation using framework-level authorization checks.

Affected Versions

ERPNext ≤ 15.98.0
ERPNext 16.0.0-rc.1 through 16.6.0

Fixed Versions

ERPNext 15.98.1
ERPNext 16.6.1

Immediate upgrade is strongly recommended.

Technical Root Cause

ERPNext uses the Frappe framework, where backend Python methods can be exposed via API using decorators such as:

@frappe.whitelist()
@frappe.whitelist(allow_guest=True)

In affected versions, certain exposed functions performed operations on documents using parameters such as:

dt (DocType)
dn (DocName)
ref_doctype
docname

However, these functions did not consistently enforce:

frappe.has_permission(doctype, "read", docname)

As a result, a remote caller could directly invoke these methods and request access to documents by guessing or enumerating valid document names.

The vulnerability was introduced due to improper authorization enforcement rather than authentication bypass at the framework level. The framework supports access control, but it was not properly implemented in specific endpoints.

Attack Scenario

An attacker identifies an internet-exposed ERPNext instance.
The attacker sends HTTP requests to /api/method/... endpoints.
Crafted parameters such as dt and dn are supplied.
If the document exists, the system returns its contents without validating user permissions.
Sensitive data such as invoices, payment requests, supplier details, or internal attachments are exposed.

If document names follow predictable patterns (e.g., INV-2026-00001), automated enumeration becomes trivial.

Impact Assessment

Confidentiality Impact

Highly sensitive financial and operational documents can be exposed.

Integrity Impact

If write-enabled endpoints were affected, unauthorized modification of documents may be possible.

Availability Impact

No direct denial-of-service vector identified.

Business Risk

Exposure of invoices, payment records, vendor information, and customer data may lead to:

Financial fraud
Business email compromise amplification
Regulatory penalties
Reputation damage

Proof of Concept (Educational)

The following example demonstrates how the issue could be tested in a controlled lab environment.

Example Request

GET /api/method/erpnext.accounts.doctype.payment_request.payment_request.make_payment_request?dt=Sales%20Invoice&dn=INV-2026-00001 HTTP/1.1
Host: target-erp.local

If vulnerable, the response may include JSON output containing invoice data without authentication.

Another Example

GET /api/method/frappe.desk.form.load.getdoc?doctype=Sales%20Invoice&name=INV-2026-00001

If the system returns document metadata or full document structure without requiring login, the system is likely vulnerable.

This testing should only be performed in authorized environments.

Exploitability Analysis

Attack Complexity: Low
Privileges Required: None (for affected endpoints)
User Interaction: Not required
Network Exposure Required: Yes

Even though no public exploit kit has been released, exploitation requires only basic HTTP request crafting. Therefore, risk remains high for exposed instances.

Detection Strategy

Detection should focus on abnormal API method invocation patterns and document enumeration attempts.

Log Sources to Monitor

Nginx access logs
Apache access logs
ERPNext/Frappe application logs
Reverse proxy logs
WAF logs
Cloud load balancer logs

Indicators of Exploitation

Repeated requests to /api/method/
Presence of parameters such as dt=, dn=, doctype=, docname=
High request frequency from single IP
Sequential document name access patterns
Anonymous access returning HTTP 200 responses

Detection Queries

Splunk Query

index=web_logs
uri_path="/api/method/*"
| search uri_query="*dt=*" AND uri_query="*dn=*"
| stats count by clientip, uri_path, uri_query
| where count > 5

Elastic (KQL)

url.path : "/api/method/*" and
url.query : (*dt=* and *dn=*)

Microsoft Sentinel (KQL)

CommonSecurityLog
| where RequestURL contains "/api/method/"
| where RequestURL contains "dt=" and RequestURL contains "dn="
| summarize count() by SourceIP, RequestURL
| where count_ > 5

Nginx Log Grep

grep "/api/method/" access.log | grep "dt=" | grep "dn="

Suspicious Enumeration Pattern Detection

index=web_logs
uri_query="*INV-2026-*"
| stats count by clientip
| where count > 20

This may indicate invoice brute-force enumeration.

Mitigation and Hardening

Immediate Actions

Upgrade to patched versions immediately.
Restrict external access to ERPNext admin/API endpoints.
Enforce VPN or IP allowlisting for backend access.
Deploy WAF rules blocking suspicious /api/method/ parameter combinations.
Enable detailed application logging.

Temporary Mitigation (If Patch Delayed)

Disable guest access wherever possible.
Review all @frappe.whitelist(allow_guest=True) usages.
Implement reverse proxy filtering to block anonymous API calls.

Forensic Investigation Checklist

Identify first suspicious /api/method/ request.
Extract full request parameters.
Determine whether sensitive documents were accessed.
Check for large response sizes from anonymous sessions.
Audit document access logs within ERPNext.
Correlate IP address with known threat intelligence feeds.
Reset credentials and rotate API keys if exposure suspected.

MITRE ATT&CK Mapping

T1190 – Exploit Public-Facing Application
T1213 – Data from Information Repositories
T1040 – Network Sniffing (post-exfiltration scenario)

Risk Rating Justification

The vulnerability scores high because:

It is remotely exploitable.
It requires no authentication in certain scenarios.
Sensitive ERP data is exposed.
Exploitation requires minimal technical effort.

While remote code execution is not involved, the business impact of document exposure justifies critical severity.

Remediation Confirmation Steps

After patching:

Verify ERPNext version: bench version
Attempt controlled API request without authentication.
Confirm response returns HTTP 403 or permission error.
Validate logs show denied access attempts.

Conclusion

CVE-2026-27471 represents a serious authorization failure in ERPNext where internal document access controls were not properly enforced at exposed API endpoints. The vulnerability is simple in nature but high in impact. Systems exposed to the internet should be treated as high risk until upgraded.

Patching remains the only complete remediation. Continuous monitoring and strict API access controls should be maintained even after upgrade.

CVE-2026-27471: Critical ERPNext Access Control Flaw Exposes Sensitive Business Documents to Remote Attackers