Description
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
Published: 2026-10-12
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure via SQL Injection
Action: Immediate Patch
AI Analysis

Impact

Endpoints in Frappe ERPNext allow SQL injection when input validation is missing. An attacker who is authenticated can construct requests that alter database queries to read confidential data. The flaw is a classic example of improper handling of user input (CWE-89).

Affected Systems

The vulnerability affects Frappe ERPNext versions prior to 15.102.0 and all 16.x releases before 16.11.0. Systems running those releases without the relevant patches are vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates a moderate‑to‑high impact with a moderate probability of exploitation. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, so the current exploitability may be limited to environments where attackers can authenticate. Nevertheless, authentication grants the attacker access to privileged data, so the risk remains significant until a fix is applied or the vulnerable endpoints are otherwise blocked.

Generated by OpenCVE AI on October 13, 2026 at 00:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Frappe ERPNext to version 15.102.0 or later, or to 16.11.0 or later in the 16.x line.
  • If an upgrade is not immediately possible, disable or restrict access to the affected endpoints so that only trusted administrators can reach them.
  • Apply database access controls to limit the privileges of the ERPNext database user and monitor query logs for unusual patterns of injected SQL.

Generated by OpenCVE AI on October 13, 2026 at 00:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Description Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
Title Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
First Time appeared Frappe
Frappe erpnext
Weaknesses CWE-89
CPEs cpe:2.3:a:frappe:erpnext:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe erpnext
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Erpnext
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T13:40:50.774Z

Reserved: 2026-10-12T21:05:57.847Z

Link: CVE-2026-109649

cve-icon Vulnrichment

Updated: 2026-10-13T13:40:46.303Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T23:17:31.213

Modified: 2026-10-13T14:17:28.747

Link: CVE-2026-109649

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T01:45:17Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')