Frappe ERPNext EUVD-2026-98002

Exploitation requires an authenticated session on the target ERPNext instance, but only the lowest possible privilege level - the advisory explicitly states 'any authenticated user, including one with no assigned roles' can exploit it, so no specific role, permission, or administrative access is needed. The attacker must reach one of several specific endpoints that lack input validation and send specially crafted (SQL-injecting) request parameters. LIMITING FACTORS: a valid account is required (PR:L), so instances that restrict account creation and tightly control credentials raise the bar; conversely, deployments permitting self-registration or broad low-privilege account provisioning make the authentication requirement nearly trivial. Affected versions are ERPNext before 15.121.0 and 16.x before 16.34.0 - instances on 15.121.0+/16.34.0+ are not vulnerable. No user interaction and no non-default configuration are required to trigger the flaw.

This is a genuine priority for any organization running ERPNext, though the severity is tempered by the authentication requirement. The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) scores 8.7 and accurately reflects a network-reachable, low-complexity attack with high impact to confidentiality, integrity, and availability - but it requires low-level privileges (PR:L). The critical nuance is that the description states 'any authenticated user, including one with no assigned roles' can exploit it, which means the PR:L barrier is extremely low: in ERPNext deployments that allow self-registration or that provision many low-privilege accounts, the effective barrier to exploitation approaches that of an unauthenticated flaw. The high-value outcome - reading other users' sensitive data and escalating to a privileged account - makes this attractive for both insider threats and attackers who obtain any foothold credential. Weighing the signals: no EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no evidence of active or widespread exploitation at this time. The absence of these signals does NOT lower the intrinsic risk; it only indicates the flaw is not yet confirmed as weaponized. Net: a real, high-priority issue for ERPNext operators (patch promptly), but currently in a 'high-severity, no-confirmed-exploitation' state rather than an actively-exploited emergency.

An attacker obtains or self-registers a minimal ERPNext account with no assigned roles, then sends specially crafted requests to one of the vulnerable unvalidated endpoints, injecting SQL to read other users' sensitive records from the database. Using the exposed data (such as credentials, tokens, or account details), the attacker pivots to escalate into a privileged administrative account. No public exploit code was identified at time of analysis, but the attack complexity is low (AC:L) and requires no user interaction.