Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an SQL injection flaw that allows any authenticated user, even one with no assigned roles, to send requests containing unsanitized input to vulnerable endpoints. The flaw lets the attacker inject arbitrary SQL, enabling the retrieval of sensitive data belonging to other users and the ability to elevate privileges to a privileged account. This can lead to both unauthorized data disclosure and unauthorized administrative access.

The vulnerability affects the ERPNext product from Frappe. Specifically, all releases prior to 15.121.0 and all 16.x releases before 16.34.0 are susceptible. Users running any of these affected versions should verify their installations against the vendor list above.

The CVSS score of 8.7 reflects a high severity, and although EPSS data is not available and the issue is not listed in CISA KEV, the risk is still significant because the vulnerability requires only an authenticated session, which attacks can easily obtain. Exploitation can be achieved by sending crafted HTTP requests to the exposed endpoints. The lack of role restrictions on the attacker makes the attack vector straightforward for authenticated users with limited permissions. The overall risk is high for organizations running the affected software.