CVE-2026-109649: Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests
Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ERPNext versions before 15.102.0 are affected, as are 16.x versions before 16.11.0. The issue is in some endpoints that do not adequately validate request input.
What does an attacker need to exploit this issue?
An attacker needs an authenticated ERPNext account and network access to send specially crafted requests to affected endpoints. No user interaction is required.
What is the likely impact of successful exploitation?
Successful exploitation can manipulate database queries and extract sensitive information from the database. The provided impact information identifies confidentiality impact as high, with no integrity or availability impact stated.
What should teams do first?
Upgrade affected ERPNext 15 deployments to 15.102.0 or later, and affected 16.x deployments to 16.11.0 or later. Prioritize systems where authenticated users may be untrusted or where ERPNext contains sensitive database records.