Description
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
Published: 2026-10-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection allowing sensitive data extraction
Action: Patch
AI Analysis

Impact

Frappe ERPNext versions before 15.106.0 and 16.x before 16.16.0 suffer from a missing input validation flaw that permits SQL injection. Authenticated users with low privileges can craft malicious requests to certain endpoints, leading to the execution of arbitrary SQL statements and the extraction of sensitive database information. This flaw is classified as CWE-89, a classic injection weakness that compromises data confidentiality.

Affected Systems

The vulnerability affects the Frappe ERPNext application. All installations running older than version 15.106.0 or older than 16.16.0 are vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with low privileges to exploit the flaw, yet the impact on data integrity and confidentiality is significant. No evidence of remote code execution or other broader system compromise is provided in the description.

Generated by OpenCVE AI on October 13, 2026 at 00:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ERPNext to version 15.106.0 or later, or 16.16.0 or later to receive the vendor‑issued patch for missing input validation.
  • Restrict access to the vulnerable endpoints by enforcing stricter authentication or role‑based access control so that only trusted users can invoke them.
  • Implement input validation or sanitization at the application level to reject malformed parameters before they reach the database query layer.

Generated by OpenCVE AI on October 13, 2026 at 00:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
Title Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-89
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-15T14:28:41.810Z

Reserved: 2026-10-12T21:05:57.847Z

Link: CVE-2026-109646

cve-icon Vulnrichment

Updated: 2026-10-15T14:28:35.567Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:30.580

Modified: 2026-10-15T15:17:27.120

Link: CVE-2026-109646

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:00:14Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')