CVE-2026-109638: Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation

Q: Which deployments are affected?

Frappe ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0. The provided information does not identify which specific endpoints contain the vulnerable input handling.

Q: Does exploitation require authentication or user interaction?

An attacker must be authenticated and able to send specially crafted requests to affected endpoints. No user interaction is required.

Q: What could an attacker gain through successful exploitation?

Successful SQL injection can let an authenticated attacker manipulate database queries and extract sensitive information from the database. The provided information does not indicate database modification or service-disruption impact.

Q: How should teams prioritize remediation?

Upgrade ERPNext to 15.110.0 or later on the 15.x branch, or to 16.21.0 or later on the 16.x branch. Until upgrading is possible, limit access to authenticated ERPNext accounts and review requests to affected endpoints for specially crafted input, though the specific endpoints are not identified in the provided data.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database.

Affected Software

1 affected component

Frappe ERPNext<15.110.0, >=16.0<16.21.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe ERPNext versions before 15.110.0 are affected, as are 16.x versions before 16.21.0. The provided information does not identify which specific endpoints contain the vulnerable input handling.

Does exploitation require authentication or user interaction?

An attacker must be authenticated and able to send specially crafted requests to affected endpoints. No user interaction is required.

What could an attacker gain through successful exploitation?

Successful SQL injection can let an authenticated attacker manipulate database queries and extract sensitive information from the database. The provided information does not indicate database modification or service-disruption impact.

How should teams prioritize remediation?

Upgrade ERPNext to 15.110.0 or later on the 15.x branch, or to 16.21.0 or later on the 16.x branch. Until upgrading is possible, limit access to authenticated ERPNext accounts and review requests to affected endpoints for specially crafted input, though the specific endpoints are not identified in the provided data.

CVE-2026-109638: Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker gain through successful exploitation?

How should teams prioritize remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require authentication or user interaction?

What could an attacker gain through successful exploitation?

How should teams prioritize remediation?