CVE-2026-109608: Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.121.0 are affected, as are 16.x versions before 16.34.0.
What level of access does an attacker need?
An attacker needs an authenticated ERPNext account. The issue can be exploited by users with no assigned roles, so low-privilege accounts are sufficient.
What could an attacker do after exploiting the issue?
Specially crafted requests can be used to read sensitive information belonging to other users and escalate access to a privileged account. The reported impact includes confidentiality, integrity, and availability consequences.
Are unauthenticated internet users able to exploit this directly?
The available information states that authentication is required. It does not indicate that unauthenticated users can exploit the vulnerable endpoints directly.