Which versions of Frappe are affected by CVE-2026-35614?

Frappe versions prior to 16.14.0 and 15.104.0 contain a critical unauthenticated SQL injection vulnerability in the bulk_update function that allows remote attackers to directly compromise database…. A patch is available.

How to fix or mitigate CVE-2026-35614?

Within 24 hours: Identify all Frappe deployments and document current versions (check frappe/__init__.py or admin panel). Within 7 days: Upgrade Frappe to version 16.14.0 or later (if on v16 branch) or version 15.104.0 or later (if on v15 branch)-apply patches to all environments (development, staging, production). Within 30 days: Conduct database integrity audit, review access logs for the bulk_update endpoint (/api/resource/*/bulk_update), and implement network segmentation to restrict API access.

Frappe CVE-2026-35614

Q: What is the CVSS score of CVE-2026-35614?

CVE-2026-35614 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-19792 CRITICAL

SQL Injection (CWE-89)

2026-04-07 security-advisories@github.com

SQLi Frappe

9.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:45 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

16.14.0,15.104.0

EUVD ID Assigned

Apr 07, 2026 - 17:22 euvd

EUVD-2026-19792

Analysis Generated

Apr 07, 2026 - 17:22 vuln.today

CVE Published

Apr 07, 2026 - 17:16 nvd

CRITICAL 9.3

DescriptionGitHub Advisory

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe has a SQL injection in bulk_update. This vulnerability is fixed in 16.14.0 and 15.104.0.

AnalysisAI

SQL injection in Frappe's bulk_update function enables unauthenticated remote attackers to execute arbitrary SQL commands, potentially achieving complete database compromise including data exfiltration, modification, and deletion. Affects Frappe versions prior to 16.14.0 and 15.104.0. CVSS 9.3 (Critical) reflects network-accessible attack requiring no authentication or user interaction. No public exploit identified at time of analysis, though the attack surface (bulk update API endpoint) and vulnerability class (SQL injection) are well-understood by attackers.

Technical ContextAI

Frappe is a full-stack Python web application framework built on MariaDB/MySQL that powers ERPNext and similar business applications. The vulnerability resides in the bulk_update functionality, which likely processes user-supplied input for batch database operations without proper parameterization or input validation. CWE-89 (SQL Injection) occurs when untrusted data is concatenated into SQL queries, allowing attackers to inject malicious SQL syntax. The CVSS 4.0 vector (AV:N/AC:L/PR:N) confirms this is remotely exploitable over the network with low attack complexity and no privileges required, meaning any unauthenticated HTTP client can potentially trigger the injection. Given Frappe's role as a database-backed application framework, successful SQL injection could expose the entire application database schema and contents.

RemediationAI

Immediately upgrade Frappe framework to version 16.14.0 or later for version 16.x deployments, or version 15.104.0 or later for version 15.x deployments. These versions contain the vendor-released patch addressing the SQL injection in bulk_update. Deployment teams should follow standard Frappe upgrade procedures including database backups, testing in staging environments, and coordinated production rollout. Consult the GitHub Security Advisory at https://github.com/frappe/frappe/security/advisories/GHSA-583g-fg76-fhfr for additional details and potential workarounds if immediate patching is not feasible. If upgrade cannot be performed immediately, consider temporarily restricting network access to the Frappe application to trusted IP ranges or implementing web application firewall rules to filter malicious SQL syntax in POST requests to bulk update endpoints, though these are interim mitigations only and do not substitute for patching.