Frappe ERPNext: SQL injection in several endpoints allows privilege escalation
Summary
Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain SQL injection flaws in several endpoints that lack input validation. Any authenticated user, including one without assigned roles, can send crafted requests to read sensitive data of other users and escalate to a privileged account. No user interaction is needed, and the attack is possible over the network with a valid login.
Affected
- ERPNext before 15.121.0
- ERPNext 16.0.0-beta.1 to before 16.34.0
Fixed in
- Upgrade to ERPNext 15.121.0
- Upgrade to ERPNext 16.34.0
Workaround
- No workaround available; upgrading is required.
Exploitation
- No evidence of exploitation in the wild found. CISA KEV: not listed.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No confirmed public proof of concept for this CVE.
Our recommendation
- Identify all ERPNext/Frappe installations and their exact versions, including Docker images.
- Upgrade to 15.121.0 or 16.34.0 as a priority; no workaround exists.
- Review user accounts for unexpected privilege changes and recent logins, especially accounts without roles.
- Restrict internet exposure of the ERP and check access logs for unusual query or API activity.
- Note that CVE-2026-109634 is a related SQL injection fixed by the same releases.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-v38v-9h2p-hr8v github.com
- VulnCheck advisory www.vulncheck.com
- OSV CVE-2026-109608 osv.dev
- Strix CVE-2026-109608 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:41.
Original description (NVD)
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.