CVE-2026-109674 in ERPNext
Summary
by MITRE • 10/13/2026
Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input validation. Remote authenticated attackers can send specially crafted requests to the affected endpoints to manipulate database queries and extract sensitive information from the database.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The identified security flaw resides within Frappe ERPNext, a widely adopted open-source enterprise resource planning system used for managing business processes such as accounting, inventory, and human resources. Specifically, versions prior to 15.98.0 in the v15 branch and prior to 16.6.0 in the v16 branch are susceptible to an SQL injection vulnerability affecting several API endpoints. This vulnerability stems from a fundamental failure in input validation mechanisms where user-supplied data is not adequately sanitized or parameterized before being incorporated into database queries. The absence of strict type checking, escaping, or prepared statement usage allows malicious actors to inject arbitrary Structured Query Language commands directly into the backend database operations.
From an operational perspective, this vulnerability poses a severe risk because it requires only authenticated access rather than unauthenticated remote exploitation. While this limits the attack surface compared to critical authentication bypass flaws, it remains highly dangerous for organizations where employee accounts or service account credentials may be compromised through phishing, credential stuffing, or other lateral movement techniques. An attacker who has obtained valid login credentials can exploit these specific endpoints to manipulate database queries. The primary impact involves unauthorized data extraction, allowing the adversary to read sensitive information stored in the ERPNext database. This could include confidential financial records, employee personal identifiable information, customer details, and proprietary business logic configurations that are critical to organizational integrity.
The technical nature of this flaw aligns with Common Weakness Enumeration identifier CWE-89, which classifies improper neutralization of special elements used in an SQL command. By failing to properly validate or escape input fields passed through the affected API endpoints, the application allows these inputs to alter the intended logic of the database query. This enables techniques such as UNION-based extraction for retrieving data from other tables, error-based extraction for inferring schema details, and potentially blind boolean-based injection for confirming vulnerabilities without direct output visibility. The vulnerability is particularly insidious because it targets standard operational endpoints that are frequently accessed by legitimate users, making detection through basic monitoring tools more challenging unless specific query anomaly patterns are tracked.
In terms of threat modeling, this exploitation path corresponds to the ATT&CK technique T1059, Command and Scripting Interpreter, specifically when used for database interaction via SQL injection, falling under the broader category of Data from Information Repositories (T1213). The attacker leverages the application's own functionality against it to exfiltrate data without needing direct network-level access to the database server. This indirect exploitation method bypasses many perimeter security controls that focus on blocking external connections directly to the database, relying instead on the trusted relationship between the web application and its backend datastore.
To mitigate this vulnerability, organizations running affected versions of Frappe ERPNext must immediately upgrade to version 15.98.0 or later for v15 installations, or version 16.6.0 or later for v16 installations. These releases contain patches that implement proper input validation and utilize parameterized queries to prevent SQL injection attacks. In addition to upgrading, administrators should enforce the principle of least privilege by ensuring that database accounts used by the ERPNext application have minimal permissions necessary for operation, thereby limiting the potential damage if an injection is successful. Furthermore, implementing a Web Application Firewall with updated rulesets can provide an additional layer of defense by detecting and blocking common SQL injection patterns in HTTP requests before they reach the application logic. Regular security audits and code reviews focusing on database interaction layers are also recommended to prevent similar vulnerabilities from being introduced during future development cycles.