Description
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.
Published: 2026-10-12
Score: 7.1 High
EPSS: n/a
KEV: No
Impact: SQL Injection allowing sensitive data extraction by low‑privilege authenticated users
Action: Patch Immediately
AI Analysis

Impact

This vulnerability is an SQL injection flaw caused by missing input validation in several ERPNext endpoints. A compromised database can be read by attackers who do not possess administrative rights. The weakness is classified as CWE-89, indicating the manipulation of SQL statements by an attacker.

Affected Systems

The affected product is Frappe ERPNext. Versions before 15.119.1 and all 16.x releases before 16.32.0 are vulnerable. Affected environments include any instance that exposes the vulnerable endpoints to authenticated users with low privileges.

Risk and Exploitability

The CVSS score of 7.1 places the vulnerability in the high‑severity range, but the EPSS score is not available, leaving the current exploitation probability uncertain. The vulnerability is not listed in the CISA KEV catalog. An attacker who can authenticate as a low‑privilege user can send specially crafted requests to the vulnerable endpoints to inject malicious SQL and exfiltrate sensitive data. The attack vector requires authenticated access, but no elevated privileges are required.

Generated by OpenCVE AI on October 12, 2026 at 23:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.119.1 or later, or to 16.32.0 or later for 16.x series
  • Disable or restrict access to the vulnerable endpoints for low‑privilege users until the patch is applied
  • Verify that input validation is enforced on all ERPNext endpoints and consider performing a security audit of custom modules

Generated by OpenCVE AI on October 12, 2026 at 23:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.
Title Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-89
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-12T22:21:57.854Z

Reserved: 2026-10-12T21:03:50.774Z

Link: CVE-2026-109609

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:24.660

Modified: 2026-10-12T23:17:24.780

Link: CVE-2026-109609

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T00:00:16Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')