CVE-2026-114664 in Frappe
Summary
by MITRE • 10/22/2026
Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The Frappe Framework, a popular low-code platform used for building web applications, contains a critical security flaw identified as a blind SQL injection vulnerability within the frappe.desk.doctype.event.event.get_events method prior to version 16.33.0. This specific component is responsible for retrieving event data from the database, typically serving calendar views or scheduling interfaces in enterprise resource planning and customer relationship management applications built on Frappe. The root cause of this vulnerability lies in the improper neutralization of user-supplied input before it is incorporated into SQL queries. Specifically, the application fails to adequately sanitize parameters passed through the get_events endpoint, allowing an attacker to inject malicious SQL code that alters the logic of the underlying database query. This lack of proper validation and escaping mechanisms creates a direct pathway for data exfiltration if left unpatched.
From a technical perspective, this vulnerability is classified as a blind SQL injection because it does not return error messages or directly display injected results in the application interface. Instead, attackers must rely on inference techniques to extract information. By sending crafted input that triggers distinct behavioral responses from the application based on true or false conditions within the database query, an attacker can systematically deduce data character by character. This method allows for the extraction of sensitive database contents such as user credentials, personal identifiable information, and proprietary business logic stored in the backend database. The vulnerability is particularly dangerous because it requires authentication to exploit, meaning that any valid user account with access to the events module can be leveraged to compromise the entire system's data integrity.
The operational impact of this flaw extends beyond simple data theft. An authenticated attacker could potentially escalate privileges by manipulating query results to bypass authorization checks or extract administrative credentials stored in the database. This leads to a complete loss of confidentiality and, depending on the specific SQL commands injected, potential disruption of service through destructive queries such as DROP TABLE statements. The ability to infer query results means that even without direct output visibility, the attacker gains significant control over the application's data layer. For organizations relying on Frappe for critical operations, this represents a severe risk to business continuity and regulatory compliance, particularly under frameworks like GDPR or HIPAA where unauthorized access to sensitive records is strictly prohibited.
In alignment with industry standards, this vulnerability maps directly to CWE-89: Improper Neutralization of Special Elements used in an SQL Command, which describes the failure to properly sanitize user input before its inclusion in a database query. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this exploitation technique aligns with T1059.004: SQL Commands, specifically under the Data Staging or Collection phases where attackers manipulate backend systems to gather information without triggering immediate alarms due to the blind nature of the injection. The lack of output visibility makes detection more challenging for standard intrusion detection systems that rely on explicit error logs or response body analysis.
To mitigate this vulnerability, organizations must immediately upgrade the Frappe Framework to version 16.33.0 or later, where the issue has been resolved through improved input validation and parameterized query implementations. For environments where immediate patching is not feasible due to dependency constraints, temporary mitigations should include implementing strict web application firewall rules that detect common SQL injection patterns in event-related API calls. Additionally, enforcing principle of least privilege ensures that user accounts have minimal necessary permissions within the database, limiting the potential damage even if an injection occurs. Regular security audits and code reviews focusing on data access layers are essential to prevent similar flaws from being introduced during future development cycles.