Frappe ERPNext CVE-2026-109638

Exploitation requires an authenticated session on the ERPNext instance (CVSS PR:L), meaning the attacker must possess valid low-privilege credentials before reaching the vulnerable code. The specific prerequisite is sending crafted input to the affected (unnamed) endpoints that perform database queries without proper input validation; no special non-default configuration, user interaction, or elevated privileges are stated as required. The principal limiting factor is the authentication barrier - this cannot be triggered by a fully unauthenticated remote attacker - and the affected deployment must be running a version before 15.110.0 or a 16.x version before 16.21.0. Impact is confined to reading data (confidentiality); no write or integrity manipulation is indicated by the CVSS vector.

This is a legitimate but moderate-priority issue rather than an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack requiring low-level authentication (PR:L), with impact limited to confidentiality (VC:H, VI:N, VA:N) - consistent with a read-oriented SQL injection used to extract data rather than modify it or achieve code execution. All signals align internally: the CWE-89 classification, the description's emphasis on extracting sensitive information, and the confidentiality-only impact agree with each other. No EPSS score, CISA KEV listing, or POC is present in the input, so exploitation likelihood cannot be quantified from the data provided; per precision rules this is 'no public exploit identified at time of analysis.' The key limiting factor is the PR:L authentication requirement - any valid ERPNext account can attempt it, but an attacker must first obtain credentials, which tempers real-world urgency compared to an unauthenticated flaw. Note the gap: VulnCheck reported this and a GHSA advisory exists, but no exploitation-probability signals were supplied, so prioritization should lean on the authenticated-but-low-barrier nature plus ERPNext's role as a repository of business and financial data.

An attacker who holds any low-privileged authenticated ERPNext account (self-registered, a compromised employee login, or a low-tier user) sends specially crafted input to one of the affected endpoints that lacks proper input validation. The malformed parameter is concatenated into a backend database query, letting the attacker manipulate the query to read data they are not authorized to see, such as other users' records, financial data, or credentials. No public exploit code is identified at time of analysis, so this reflects the described capability rather than a confirmed weaponized exploit.