CVE-2026-109646 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated low-privileged attackers can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext versions prior to 15.106.0 and version 16.x prior to 16.16.0, specifically affecting certain API endpoints that handle user input without adequate sanitization or parameterized query execution. This vulnerability is classified as an SQL injection, which corresponds to CWE-89 in the Common Weakness Enumeration standard. The root cause of this issue lies in the application's failure to properly validate and escape user-supplied data before incorporating it into dynamically constructed SQL queries. When a request reaches these vulnerable endpoints, the input is directly concatenated or interpolated into the database command string without sufficient checks for malicious syntax, allowing an attacker to manipulate the intended query structure.
The operational impact of this vulnerability is significant because it allows authenticated attackers with low-privileged accounts to execute arbitrary SQL commands against the underlying database. Unlike vulnerabilities that require administrative privileges, this flaw can be exploited by users who have basic access rights within the ERPNext environment, such as standard employees or departmental staff members. By crafting specially formatted HTTP requests containing malicious SQL payloads, an attacker can bypass application-level logic and interact directly with the database engine. This capability enables the extraction of sensitive information stored in the database, including but not limited to user credentials, financial records, customer personal data, and proprietary business intelligence. The ability to read arbitrary data compromises the confidentiality integrity of the entire system, potentially leading to further exploitation such as privilege escalation or complete system compromise if combined with other vulnerabilities.
From a tactical perspective, this vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically SQL injection sub-techniques used for unauthorized data access. Attackers can leverage tools like sqlmap or custom scripts to automate the extraction of database schema information and dump critical tables. The lack of input validation means that even simple boolean-based blind SQL injection techniques could be employed to infer database contents byte by byte if error messages are not properly suppressed, although direct query execution is also possible depending on the specific endpoint implementation and backend configuration. This represents a severe risk to organizations relying on ERPNext for critical business operations, as data exfiltration can lead to regulatory non-compliance under frameworks such as GDPR or HIPAA, depending on the nature of the stored data.
To mitigate this vulnerability, immediate action is required by upgrading the Frappe and ERPNext installations to version 15.106.0 or later for the v15 branch, or version 16.16.0 or later for the v16 branch. These updates include patches that enforce strict input validation and utilize parameterized queries to prevent SQL injection attacks. In addition to upgrading, organizations should implement Web Application Firewalls configured with rulesets capable of detecting common SQL injection patterns in HTTP requests as a compensating control. It is also recommended to review application code for similar patterns where dynamic query construction occurs without proper escaping mechanisms. Regular security audits and penetration testing focusing on input validation across all API endpoints will help identify and remediate similar weaknesses before they can be exploited by malicious actors.