Frappe Framework EUVD-2026-107699

Requires an authenticated session on the target Frappe/ERPNext application (CVSS PR:L - any valid low-privilege user account is sufficient, not an administrator), after which the attacker sends crafted, improperly-neutralized input to the specific frappe.desk.doctype.event.event.get_events method. Because the flaw is blind, exploitation depends on the attacker being able to observe differential application behavior/responses to inferred boolean conditions. Limiting factors: exploitation is impossible for fully unauthenticated outsiders, so the practical attack surface is governed by how accounts are provisioned (self-registration or multi-tenant portals widen it); affected deployments must run a Frappe Framework version before 16.33.0. No special non-default configuration or user interaction is otherwise required.

This is a moderate-priority, authentication-gated vulnerability rather than a critical internet-wide emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) scores 7.1 (High) and confirms network-reachable, low-complexity exploitation that requires low-level privileges (PR:L) - i.e., any authenticated user account suffices, there is no user-interaction requirement, and the dominant impact is high confidentiality (VC:H) via blind data extraction with only limited integrity impact (VI:L) and no availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code provided in the input, so all three real-world exploitation signals are currently absent; this places the issue in the 'elevate due to high confidentiality impact and low attack complexity, but temper because exploitation requires authentication and no active exploitation is evidenced' category. No SSVC decision data was supplied. The key tempering factor is PR:L: because any authenticated (even low-privilege) user can reach get_events, the real exposure depends heavily on how freely accounts are provisioned on a given Frappe/ERPNext deployment - multi-tenant or self-signup portals materially raise risk, whereas tightly controlled internal instances lower it. No conflicting signals were detected: the CVSS 4.0 vector, the CWE-89 classification, and the description (authenticated blind SQLi) are mutually consistent.

An attacker who holds any valid (even low-privilege) account on a Frappe-based application - such as an ERPNext portal user - sends crafted input to the frappe.desk.doctype.event.event.event.get_events endpoint and observes differences in application responses to infer the truth of injected boolean SQL conditions. By iterating these true/false inferences, the attacker performs blind SQL injection to extract sensitive database contents such as credentials, tokens, or other tenants' records. No public exploit code was identified in the provided data, but the low attack complexity (AC:L) makes a bespoke script straightforward to develop.