CVE-2026-65822: ERPNext: SQL Injection in "Inactive Customers" report via unvalidated `doctype` filter
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticated user to extract sensitive information and manipulate database queries. This issue is fixed in versions 15.116.0 and 16.23.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
erpnextto a version that resolves this vulnerability.Fixed in 15.116.0 - Upgrade
Upgrade
erpnextto a version that resolves this vulnerability.Fixed in 16.23.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-65822?
The severity of CVE-2026-65822 is classified as high with a score of 7.6.
How do I fix CVE-2026-65822?
To fix CVE-2026-65822, upgrade ERPNext to versions 15.116.0 or 16.23.0 or later.
What type of vulnerability is CVE-2026-65822?
CVE-2026-65822 is an SQL Injection vulnerability impacting ERPNext.
What is affected by CVE-2026-65822?
CVE-2026-65822 affects the 'Inactive Customers' report in ERPNext due to an unvalidated doctype filter.
What are the potential impacts of CVE-2026-65822?
The potential impacts of CVE-2026-65822 include unauthorized data access and possible data loss through exploitation.