Frappe ERPNext CVE-2026-109626

Exploitation requires an authenticated ERPNext user account with low privileges (CVSS PR:L) that can reach the affected endpoints over the network; no administrative rights, no user interaction, and no non-default configuration are required, as the flaw lies in missing input validation in multiple application endpoints that ship in affected versions (before 16.34.2). The primary limiting factor is the authentication requirement - an attacker must first obtain or be issued valid low-privilege credentials - which excludes fully anonymous internet-wide exploitation. Impact is bounded to data extraction (confidentiality); the vector reports no integrity or availability impact, so this is not a remote code execution or data-destruction condition based on available data.

This is a moderate, authentication-gated risk rather than an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and is internally consistent with the description: network-reachable, low attack complexity, requires low privileges (an authenticated low-privileged account), no user interaction, and high confidentiality impact with no integrity or availability impact - matching an SQL injection used to 'extract sensitive information from the database.' No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable near-term exploitation; the risk is driven by severity potential, not by observed exploitation. The key limiting factor is the PR:L requirement - an attacker must already hold a valid low-privilege ERPNext account, which narrows this to authenticated insiders or attackers who have obtained credentials, making it most dangerous in multi-tenant or broadly-provisioned ERPNext deployments. No conflicting signals were detected between the CVSS vector and the description; both agree on authenticated network access with confidentiality-only impact. Missing data: EPSS, KEV, and POC status are all absent and should be monitored, as a future POC would raise exploitation likelihood for this low-complexity, low-privilege class of flaw.

An attacker with a valid low-privilege ERPNext account (or stolen credentials) sends specially crafted requests to one of the affected endpoints, injecting SQL into a query that lacks input validation. Because attack complexity is low and no user interaction is needed, the attacker iteratively extracts sensitive records - financials, customer data, user hashes - directly from the backend database. No public exploit was identified at the time of analysis, so weaponization effort is currently on the attacker.