A lack of input validation enables attackers who have authenticated but low-privilege accounts to craft requests that inject arbitrary SQL statements through multiple API endpoints. When the injection succeeds, the attacker can read or extract sensitive data stored in the ERPNext database, compromising confidentiality of business information. The flaw is a classic example of CWE‑89, where improper handling of database queries exposes the application to unauthorized data disclosure.

All installations of Frappe ERPNext running a version prior to 16.34.2 are susceptible. This includes the community and enterprise builds of ERPNext that have not applied the fix incorporated in release 16.34.2 or later.

The flaw scores a CVSS of 7.1, indicating a moderate to high risk severity. No EPSS score is currently available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no known public exploitation yet. Because the attack requires authenticated access with low privileges, attackers must first compromise a user account or gain valid credentials, but once achieved, they can inject SQL and exfiltrate data. The combination of moderate severity, lack of existing exploitation incidents, and the need for valid credentials places the threat at a noticeable but manageable level for organizations running vulnerable ERPNext versions.