Frappe ERPNext CVE-2026-109609

Exploitation requires an authenticated session with at least low-privilege access to an ERPNext instance (PR:L), after which crafted requests are sent to specific endpoints that lack input validation. The vulnerability is version-bounded: only ERPNext before 15.119.1 and 16.x before 16.32.0 are affected, so patched instances are not exploitable. The main limiting factor is the authentication requirement - an attacker must already possess valid (even if minimally privileged) credentials - which narrows realistic exploitation to insiders, compromised accounts, or multi-tenant/self-service-registration deployments; no special non-default server configuration is stated as required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: a network-reachable, low-complexity SQL injection that requires authentication (PR:L) and yields high confidentiality impact with no integrity or availability impact - matching the 'extract sensitive information' wording. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC referenced in the provided intelligence, so this is not confirmed active exploitation. EPSS is absent from the input, so real-world exploitation probability cannot be quantified from the data given. The authentication requirement (PR:L) meaningfully lowers the risk versus an unauthenticated SQLi: an attacker needs a valid low-privilege ERPNext account, which constrains this toward insider, compromised-credential, or multi-tenant abuse scenarios rather than opportunistic internet-wide scanning. Net assessment: a genuine confidentiality risk worth prioritizing for internet-exposed or multi-tenant ERPNext instances, but the auth prerequisite and lack of KEV/POC evidence make it a patch-on-schedule issue rather than an emergency, absent EPSS data to indicate broader interest.

An attacker who holds or obtains a low-privilege ERPNext account (e.g., a limited internal user or compromised credential) sends a specially crafted request to one of the endpoints that lacks input validation, embedding SQL syntax in a parameter. Because the input is not sanitized, the injected SQL executes against the ERPNext database, allowing the attacker to read sensitive records beyond their authorization. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means exploitation is reliable once the vulnerable endpoint and parameter are known.