CVE-2026-109608 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within the Frappe ERPNext framework, specifically affecting versions prior to 15.121.0 in the legacy branch and version 16.x prior to release 16.34.0. This vulnerability manifests as a SQL injection defect across multiple API endpoints that fail to implement adequate input validation or parameterization for user-supplied data. The core technical issue stems from the application's failure to properly sanitize query parameters before incorporating them into dynamic database queries, allowing an attacker to inject arbitrary Structured Query Language commands. Because this flaw exists in foundational request handling mechanisms rather than specific business logic modules, it presents a broad attack surface accessible through various standard interaction points within the ERP system.
A critical aspect of this vulnerability is its low barrier for exploitation regarding authentication and authorization requirements. Unlike many SQL injection flaws that require high-level administrative privileges to be effectively leveraged, this defect can be exploited by any authenticated user account, including those with no assigned roles or minimal permissions. This characteristic significantly elevates the severity of the risk because it allows external attackers who have obtained valid credentials through phishing, credential stuffing, or other initial access vectors to immediately pivot toward more severe outcomes without needing further privilege escalation steps within the application's role-based access control system. The lack of strict input validation means that even basic user accounts can manipulate backend database operations directly.
The operational impact of this vulnerability is substantial and multifaceted. Primarily, it enables unauthorized data exfiltration where an attacker can read sensitive information belonging to other users or the organization at large. This includes personally identifiable information, financial records, customer details, and proprietary business intelligence stored within the ERPNext database. Furthermore, due to the nature of SQL injection capabilities, an attacker with sufficient knowledge of the underlying database schema may be able to escalate privileges by manipulating administrative functions or modifying access control tables directly through crafted queries. This could lead to a complete compromise of system integrity, allowing for data modification, deletion, or even remote code execution depending on the specific database configuration and permissions granted to the application's database user account.
From a classification perspective, this vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command within the Common Weakness Enumeration framework. It also maps closely to MITRE ATT&CK technique T1059 Command and Scripting Interpreter via SQL injection, which falls under the broader category of Defense Evasion or Credential Access depending on the specific payload executed. The ability for low-privileged users to access high-value data represents a significant failure in both input validation controls and principle of least privilege enforcement within the application's architecture.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.121.0 or later, or version 16.34.0 and above for the newer branch. These releases contain patches that implement proper parameterized queries and enhanced input validation across the vulnerable endpoints. In addition to upgrading, administrators should audit existing user accounts to ensure that no unnecessary privileged roles are assigned to standard users and enforce strict password policies to reduce the likelihood of initial credential compromise. Implementing a Web Application Firewall with rules specifically tuned for SQL injection patterns can provide an additional layer of defense during the transition period or if immediate patching is not feasible, although upgrading remains the only definitive remediation strategy.