CVE-2026-109626: Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Q: Who can exploit this vulnerability?

An authenticated ERPNext user with low privileges can exploit it. Exploitation does not require user interaction and can be performed remotely by sending crafted requests to vulnerable endpoints.

Q: What is the likely impact of successful exploitation?

An attacker may inject SQL statements and extract sensitive information from the ERPNext database. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Q: Which deployments should be prioritized for remediation?

ERPNext deployments running versions earlier than 16.34.2 should be prioritized, particularly instances that allow low-privileged user accounts. The affected functionality involves multiple endpoints, so exposure is not limited to a single endpoint based on the available information.

Q: How can I determine whether an instance is affected?

Verify the deployed ERPNext version. Instances before 16.34.2 are affected according to the advisory information provided.

Published Oct 12, 2026

Updated

Frappe ERPNext before 16.34.2 contains an SQL injection vulnerability caused by missing input validation in multiple endpoints. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.

Affected Software

1 affected component

Frappe ERPNext<16.34.2

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An authenticated ERPNext user with low privileges can exploit it. Exploitation does not require user interaction and can be performed remotely by sending crafted requests to vulnerable endpoints.

What is the likely impact of successful exploitation?

An attacker may inject SQL statements and extract sensitive information from the ERPNext database. The provided severity vector indicates high confidentiality impact, with no stated integrity or availability impact.

Which deployments should be prioritized for remediation?

ERPNext deployments running versions earlier than 16.34.2 should be prioritized, particularly instances that allow low-privileged user accounts. The affected functionality involves multiple endpoints, so exposure is not limited to a single endpoint based on the available information.

How can I determine whether an instance is affected?

Verify the deployed ERPNext version. Instances before 16.34.2 are affected according to the advisory information provided.

CVE-2026-109626: Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints

Affected Software

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which deployments should be prioritized for remediation?

How can I determine whether an instance is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which deployments should be prioritized for remediation?

How can I determine whether an instance is affected?