CVE-2026-109609: Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Q: Which deployments are affected?

ERPNext versions before 15.119.1 are affected, as are 16.x versions before 16.32.0.

Q: What level of access does an attacker need?

An attacker must be authenticated to ERPNext, but only low privileges are required. Exploitation does not require user interaction.

Q: What can an attacker gain through exploitation?

The vulnerability allows crafted requests to vulnerable endpoints to inject SQL and extract sensitive information from the ERPNext database. The provided impact information indicates confidentiality impact without integrity or availability impact.

Q: How can I determine whether my instance is exposed?

Check the deployed ERPNext version. Instances running a release earlier than 15.119.1, or a 16.x release earlier than 16.32.0, should be treated as affected.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database.

Affected Software

1 affected component

Frappe ERPNext<15.119.1, <16.32.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ERPNext versions before 15.119.1 are affected, as are 16.x versions before 16.32.0.

What level of access does an attacker need?

An attacker must be authenticated to ERPNext, but only low privileges are required. Exploitation does not require user interaction.

What can an attacker gain through exploitation?

The vulnerability allows crafted requests to vulnerable endpoints to inject SQL and extract sensitive information from the ERPNext database. The provided impact information indicates confidentiality impact without integrity or availability impact.

How can I determine whether my instance is exposed?

Check the deployed ERPNext version. Instances running a release earlier than 15.119.1, or a 16.x release earlier than 16.32.0, should be treated as affected.

CVE-2026-109609: Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What can an attacker gain through exploitation?

How can I determine whether my instance is exposed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What level of access does an attacker need?

What can an attacker gain through exploitation?

How can I determine whether my instance is exposed?