CVE-2026-109647 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext, a widely adopted open-source enterprise resource planning platform used for managing business processes such as accounting, inventory, and human resources. The vulnerability affects versions prior to 15.106.0 in the v15 branch and prior to 16.16.0 in the v16 branch. This issue is classified under CWE-89, which denotes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The root cause lies in insufficient input validation within multiple API endpoints that handle user-supplied data without properly sanitizing or parameterizing it before inclusion in database queries.
Because the vulnerability requires authentication to exploit, it is categorized under CWE-287, Improper Authentication, although the primary technical flaw remains the injection mechanism itself. An authenticated attacker can leverage this weakness by crafting malicious HTTP requests that inject arbitrary SQL code into the query parameters. This allows the attacker to manipulate the backend database logic, potentially bypassing intended access controls and executing commands with the privileges of the application's database user account.
The operational impact of this vulnerability is severe due to the sensitive nature of data typically stored in ERPNext databases. Successful exploitation can lead to unauthorized disclosure of confidential business information, including customer details, financial records, employee personal identifiable information, and proprietary trade secrets. Beyond simple data exfiltration, an attacker with sufficient privileges could potentially modify or delete critical database entries, leading to data integrity compromise and operational disruption within the organization's workflow systems.
This vulnerability aligns with MITRE ATT&CK technique T1059.004, Command and Scripting Interpreter: SQL Commands, which describes how attackers use structured query language as a vehicle for executing malicious actions against database-driven applications. The attack vector is classified as Network-based but requires prior authentication, placing it in the context of lateral movement or privilege escalation within an already compromised user session rather than initial external network intrusion.
To mitigate this risk, organizations running affected versions must immediately upgrade to Frappe ERPNext version 15.106.0 or later for v15 users, and version 16.16.0 or later for v16 users. These releases contain patches that implement proper input validation and parameterized queries to prevent SQL injection attacks. In the interim, if upgrading is not immediately feasible, administrators should enforce strict access controls on affected endpoints, ensure all user accounts have strong authentication mechanisms such as multi-factor authentication, and monitor database logs for anomalous query patterns indicative of exploitation attempts. Regular security audits and penetration testing are also recommended to identify similar input validation weaknesses across other modules within the ERPNext ecosystem.