A flaw in certain endpoints of Frappe ERPNext allows attackers who have authenticated with high privileges to inject arbitrary SQL. The lacking input validation permits crafted requests to read data from the database, potentially revealing confidential information.

Frappe ERPNext versions prior to 15.121.0 and all 16.x releases before 16.34.0 are vulnerable. Updated releases contain the fix; earlier versions should be upgraded or otherwise isolated.

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available and the vulnerability is not listed in KEV, suggesting it has not yet been widely exploited. However, exploitation requires authenticated access with high privilege, which limits the attack surface to users with significant rights. Still, the potential for data leakage warrants immediate remediation.