Frappe ERPNext CVE-2026-109646

Requires a valid authenticated session with a low-privileged ERPNext account (CVSS PR:L), after which the attacker targets specific unvalidated endpoints in ERPNext versions before 15.106.0 or 16.x before 16.16.0. No user interaction and no elevated privileges are needed, and the attack works over the network against affected versions. The practical limiting factors are: (1) the attacker must possess or acquire credentials - so exposure rises sharply where self-registration is enabled or many low-trust users exist, and (2) the instance must be network-reachable to the attacker. Patched versions (15.106.0 / 16.16.0 and later) are not exploitable. The precise vulnerable endpoints are not named in the available data.

This is a credible mid-tier priority rather than an emergency. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) describes a network-reachable, low-complexity attack requiring low-privileged authentication (PR:L) with no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with a read-only SQL injection that extracts data, as the description states. There is no CISA KEV listing and no publicly available exploit code was provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; no EPSS score or SSVC decision data was supplied, so probabilistic and automatable signals cannot be weighed. The signals are internally consistent (no conflict between vector and description), with the main limiting factor being the authentication requirement: an attacker needs a valid low-privileged ERPNext account, which constrains this to insiders, compromised credentials, or environments with open/weakly-controlled self-registration. Net: a confirmed SQLi worth prompt patching for any internet-exposed or multi-tenant ERPNext instance, but not a drop-everything/wormable issue absent evidence of active exploitation.

An attacker who holds or obtains low-privileged credentials on an internet-reachable ERPNext instance sends a specially crafted request to one of the vulnerable endpoints, injecting SQL through an unvalidated input parameter. Because the flaw yields high confidentiality impact, the attacker extracts sensitive records (e.g., customer, financial, or user data) directly from the backend database. No public proof-of-concept was provided in the input, so exploitation would require the attacker to independently identify the affected endpoints and injectable parameters.