CVE-2026-109631 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation, allowing crafted input to alter database queries. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to extract sensitive information from the database.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext versions prior to 15.119.1 and version 16.x prior to 16.32.0, specifically affecting certain API endpoints that fail to implement adequate input validation mechanisms. This vulnerability is classified as an SQL injection, a critical web application weakness defined under CWE-89 in the Common Weakness Enumeration standard. The root cause of this issue lies in the improper neutralization of special elements used in SQL commands within user-supplied data before it is processed by the database engine. When these specific endpoints accept input without rigorous sanitization or parameterized query usage, they create a pathway for attackers to manipulate the structure of backend database queries. This lack of validation allows malicious actors to inject arbitrary SQL code that executes with the privileges of the application's database user account.
The operational impact of this vulnerability is significant due to its accessibility by authenticated users with low privilege levels. Unlike many high-severity vulnerabilities that require administrative access, this flaw can be exploited by any valid user within the ERPNext environment, regardless of their role or permission set. An attacker leveraging this weakness can send specially crafted HTTP requests containing malicious SQL payloads to extract sensitive information directly from the database. This capability enables unauthorized data exfiltration, potentially exposing confidential business records, customer personal identifiable information, financial transactions, and internal system configurations. The ability to alter database queries also opens the door for potential data modification or deletion if the underlying database permissions allow write operations through the application's connection context, thereby compromising the integrity of critical enterprise data.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically SQL injection sub-techniques, as well as T1078 Valid Accounts if exploited by legitimate users who have been compromised or are acting maliciously internally. The exploitation vector is primarily network-based but requires authentication, which narrows the attack surface to insider threats or external attackers who have obtained valid credentials through phishing or credential stuffing attacks. This distinction makes the vulnerability particularly dangerous in enterprise environments where internal trust boundaries may be loosely enforced, allowing low-privileged users to escalate their impact significantly beyond their intended scope of access.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe ERPNext to version 15.119.1 or later for the v15 branch, and to version 16.32.0 or later for the v16 branch. These releases contain patches that enforce strict input validation and utilize parameterized queries to prevent SQL injection attacks on the affected endpoints. In addition to upgrading, administrators should review access controls to ensure that users with low privileges do not have unnecessary write permissions in the database layer, adhering to the principle of least privilege. Implementing a Web Application Firewall can also provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP traffic, although this should be viewed as a compensatory control rather than a primary fix since it does not resolve the underlying code defect. Regular security audits and static application security testing on custom modules are recommended to prevent similar vulnerabilities from being introduced during future development cycles.