CVE-2026-109648: Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Q: Which deployments are affected?

Frappe ERPNext versions earlier than 15.106.0 are affected, as are 16.x versions earlier than 16.16.0.

Q: What access does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account with low privileges. Exploitation can be performed remotely through specially crafted requests and does not require user interaction.

Q: What could an attacker obtain?

Successful exploitation can inject SQL into database queries and extract sensitive information from the underlying database. The provided impact information indicates confidentiality impact, with no stated integrity or availability impact.

Q: What should teams do if they cannot patch immediately?

The provided information does not identify a workaround or mitigation. Prioritize restricting access for untrusted or unnecessary authenticated accounts until the affected ERPNext instance can be updated.

Published Oct 12, 2026

Updated

Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database.

Affected Software

1 affected component

Frappe ERPNext<15.106.0, >=16.0.0<16.16.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:22 PM

Data Sourced

via MITRE·10:22 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Frappe ERPNext versions earlier than 15.106.0 are affected, as are 16.x versions earlier than 16.16.0.

What access does an attacker need to exploit this issue?

An attacker needs an authenticated ERPNext account with low privileges. Exploitation can be performed remotely through specially crafted requests and does not require user interaction.

What could an attacker obtain?

Successful exploitation can inject SQL into database queries and extract sensitive information from the underlying database. The provided impact information indicates confidentiality impact, with no stated integrity or availability impact.

What should teams do if they cannot patch immediately?

The provided information does not identify a workaround or mitigation. Prioritize restricting access for untrusted or unnecessary authenticated accounts until the affected ERPNext instance can be updated.

CVE-2026-109648: Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could an attacker obtain?

What should teams do if they cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

What could an attacker obtain?

What should teams do if they cannot patch immediately?