Frappe ERPNext EUVD-2026-98038

Exploitation requires a valid authenticated ERPNext session with at least low-privilege access (CVSS PR:L) that can reach the affected endpoints; the attacker then supplies unvalidated input to one of the 'multiple endpoints' to manipulate database queries. LIMITING FACTORS: authentication is mandatory (no anonymous/pre-auth path per PR:L), so risk is highest where low-privilege accounts are widely issued, self-registration is enabled, or the instance is internet-exposed and multi-tenant. Affected builds are ERPNext before 15.106.0 and 16.x before 16.16.0; patched versions remove the exposure. Impact is confined to data disclosure (VC:H) with no inherent integrity or availability impact per the vector.

This is a moderate-priority, authenticated SQL injection (CWE-89) in Frappe ERPNext, best characterized as a real but access-gated data-exposure risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack with no user interaction, but PR:L means a valid authenticated account is a hard prerequisite - this is not a pre-auth mass-exploitation primitive. Impact is scoped to confidentiality only (VC:H, VI:N, VA:N): the flaw enables reading sensitive data from the database but, per the vector, does not directly grant data modification or denial of service. No EPSS score, CISA KEV listing, or public exploit code is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis'; the absence of these signals is consistent with a recently disclosed issue reported by VulnCheck rather than evidence of active campaigns. The main uncertainty: the description says 'multiple endpoints,' so the real-world blast radius depends on which features/roles the affected endpoints require - a low-privilege but broadly granted role would materially raise risk, while an admin-only endpoint would lower it. Prioritize patching for internet-exposed, multi-tenant, or many-user ERPNext deployments where low-privilege accounts are common or self-registration is possible.

An attacker who holds (or phishes/registers) a low-privilege ERPNext account sends specially crafted input to one of the affected endpoints, where missing input validation lets attacker-controlled data alter the backend SQL query. By iterating injected payloads, the attacker reads records beyond their authorization - such as financial, customer, or HR data - effectively turning a limited account into a database read oracle. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means a motivated authenticated user could develop a working payload with standard SQLi techniques.