SQL Injection Flaw in Frappe ERPNext Software by Frappe
CVE-2026-109648

7.1HIGH

Key Information:

Vendor: Frappe
Status: Erpnext
Vendor: CVE Published:; 12 October 2026

What is CVE-2026-109648?

Frappe ERPNext prior to version 15.106.0 and 16.x before 16.16.0 is vulnerable to SQL injection due to inadequate input validation in certain endpoints. This flaw enables authenticated attackers to craft malicious requests, potentially injecting harmful SQL statements into queries. Such actions can lead to unauthorized access to sensitive information stored in the database, posing significant risks to data integrity and privacy.

Affected Version(s)

erpnext 0 < 15.106.0

erpnext 16.0.0-beta.1 < 16.16.0

erpnext 15.106.0

References

https://github.com/frappe/erpnext/security/advisories/GHS...

vendor-advisory

https://www.vulncheck.com/advisories/frappe-erpnext-befor...

third-party-advisory

CVSS V4

Score:

7.1

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 12, 2026
Vulnerability Reserved
Oct 12, 2026

Credit

odgrso

diptanilsaha

vnth4nhnt

CVE-2026-109648 Data

JSON