CVE-2026-109608: Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Q: Which deployments are affected?

ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.

Q: What level of access does an attacker need?

An attacker needs an authenticated ERPNext account. The issue can be exploited by users with no assigned roles, so low-privilege accounts are sufficient.

Q: What could an attacker do after exploiting the issue?

Specially crafted requests can be used to read sensitive information belonging to other users and escalate access to a privileged account. The reported impact includes confidentiality, integrity, and availability consequences.

Q: Are unauthenticated internet users able to exploit this directly?

The available information states that authentication is required. It does not indicate that unauthenticated users can exploit the vulnerable endpoints directly.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.

Affected Software

1 affected component

Frappe ERPNext<15.121.0, <16.34.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Oct 13, 2026

Event

via NVD·12:17 AM

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.

What level of access does an attacker need?

An attacker needs an authenticated ERPNext account. The issue can be exploited by users with no assigned roles, so low-privilege accounts are sufficient.

What could an attacker do after exploiting the issue?

Specially crafted requests can be used to read sensitive information belonging to other users and escalate access to a privileged account. The reported impact includes confidentiality, integrity, and availability consequences.

Are unauthenticated internet users able to exploit this directly?

The available information states that authentication is required. It does not indicate that unauthenticated users can exploit the vulnerable endpoints directly.

CVE-2026-109608: Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could an attacker do after exploiting the issue?

Are unauthenticated internet users able to exploit this directly?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What could an attacker do after exploiting the issue?

Are unauthenticated internet users able to exploit this directly?