What is the CVSS score of CVE-2026-32954?

CVE-2026-32954 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Erpnext are affected by CVE-2026-32954?

ERPNext versions before 15.100.0 and 16.x before 16.8.0 contain a blind SQL injection vulnerability allowing authenticated users with low privileges to extract sensitive database information,…. A patch is available.

How to fix or mitigate CVE-2026-32954?

Within 24 hours: Identify all ERPNext instances and document current versions. Within 7 days: Upgrade ERPNext to version 15.100.0 (for v15 deployments) or version 16.8.0 (for v16 deployments); test upgrades in non-production environments first. Within 30 days: Conduct access review of low-privilege user accounts and implement database activity monitoring on ERP systems to detect anomalous SQL query patterns.

Erpnext CVE-2026-32954

EUVD-2026-13547 HIGH

SQL Injection (CWE-89)

2026-03-20 security-advisories@github.com

SQLi Erpnext

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:20 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

15.100.0,16.8.0

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13547

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 05:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

ERP is a free and open source Enterprise Resource Planning tool. In versions prior to 16.8.0 and 15.100.0, certain endpoints were vulnerable to time-based and boolean-based blind SQL injection due to insufficient parameter validation, allowing attackers to infer database information. This issue has been fixed in versions 15.100.0 and 16.8.0.

AnalysisAI

A blind SQL injection vulnerability exists in ERPNext, a free and open-source Enterprise Resource Planning system, affecting versions prior to 15.100.0 and beta versions 16.0.0-beta.1 through 16.7.x. The vulnerability allows authenticated attackers with low-level privileges to perform time-based and boolean-based blind SQL injection attacks through insufficiently validated parameters on certain endpoints, enabling them to infer and extract sensitive database information. This is tagged as an SQLi vulnerability and has been assigned EUVD-2026-13547 by ENISA, with patches available in versions 15.100.0 and 16.8.0.

Technical ContextAI

ERPNext is a comprehensive open-source ERP solution built on the Frappe framework that manages business operations including accounting, inventory, and human resources. This vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL injection. The affected endpoints failed to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries, allowing attackers to manipulate query logic through crafted payloads. Blind SQL injection techniques—both time-based (measuring response delays to infer true/false conditions) and boolean-based (observing application behavior changes)—enable attackers to extract database contents character by character without direct error messages or output, making detection more challenging than traditional SQL injection.

RemediationAI

Organizations running ERPNext should immediately upgrade to version 15.100.0 or later for the version 15 release line, or to version 16.8.0 or later for those on version 16 beta releases, as documented in the official releases at https://github.com/frappe/erpnext/releases/tag/v15.100.0 and https://github.com/frappe/erpnext/releases/tag/v16.8.0. Review the complete security advisory at https://github.com/frappe/erpnext/security/advisories/GHSA-j669-ghv2-gmqg for specific details about the affected endpoints and fixes. Until patching is completed, implement defense-in-depth measures including restricting ERPNext access to trusted IP ranges via firewall rules, enforcing strong authentication policies to minimize the risk from compromised low-privilege accounts, enabling comprehensive SQL query logging to detect exploitation attempts, and conducting a security audit to identify any unauthorized data access that may have occurred prior to patching.