CVE-2026-109648: Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe ERPNext versions earlier than 15.106.0 are affected, as are 16.x versions earlier than 16.16.0.
What access does an attacker need to exploit this issue?
An attacker needs an authenticated ERPNext account with low privileges. Exploitation can be performed remotely through specially crafted requests and does not require user interaction.
What could an attacker obtain?
Successful exploitation can inject SQL into database queries and extract sensitive information from the underlying database. The provided impact information indicates confidentiality impact, with no stated integrity or availability impact.
What should teams do if they cannot patch immediately?
The provided information does not identify a workaround or mitigation. Prioritize restricting access for untrusted or unnecessary authenticated accounts until the affected ERPNext instance can be updated.