Erpnext CVE-2026-32954

Requires authenticated user access to ERP versions prior to 16.8.0 and 15.100.0. Attacker must be a logged-in user with access to vulnerable endpoints. Remote exploitation over network. No victim interaction required. Blind SQL injection enables database information disclosure.

The CVSS score of 7.1 (High) reflects network-accessible exploitation with low attack complexity, requiring only low privileges and no user interaction, with high confidentiality impact and low availability impact. The attack vector (AV:N) indicates remote exploitation is possible, while PR:L means an authenticated account is required, reducing the attack surface compared to unauthenticated vulnerabilities. The integrity impact is rated None, suggesting the primary concern is data exfiltration rather than modification. Given that ERPNext systems typically contain sensitive business data including financial records, customer information, and proprietary business intelligence, the confidentiality impact is significant for organizations using this platform. The availability of patches in versions 15.100.0 and 16.8.0 provides clear remediation paths. While no EPSS score or KEV listing is provided in the intelligence data and no public proof-of-concept is explicitly mentioned, the SQL injection vulnerability class is well-understood and easily exploitable by moderately skilled attackers once endpoints are identified. Real-world risk is elevated for internet-facing ERPNext installations with multiple user accounts, particularly those handling sensitive business data, making this a priority for organizations running affected versions.

An authenticated attacker with low-level user credentials (such as a basic employee account) accesses vulnerable ERPNext endpoints and submits crafted requests containing SQL injection payloads designed to manipulate the underlying database queries. By leveraging time-based injection techniques, the attacker measures response delays to infer whether specific conditions are true or false, systematically extracting sensitive information such as administrator credentials, financial data, customer records, or proprietary business information character by character. The network-accessible nature and low attack complexity mean this can be automated and executed remotely without requiring physical access or complex exploit chains.