Frappe ERPNext EUVD-2026-98054

Requires an authenticated session with a valid ERPNext account (PR:L) - exploitation is not possible pre-authentication. The attacker must reach one of the specific unvalidated endpoints and supply a crafted parameter that is unsafely incorporated into a database query; no special non-default configuration or user interaction is required (UI:N), and the flaw is reachable over the network against affected versions (ERPNext < 15.113.0 and 16.x < 16.22.0). The authentication requirement is the primary limiting factor; risk rises sharply where ERPNext allows open/self-service account registration or is internet-exposed, and falls where accounts are tightly provisioned to trusted users.

This is a legitimate but moderate-priority issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H) describes a network-reachable, low-complexity SQL injection that an authenticated low-privileged user can trigger to read sensitive database contents, with no integrity or availability impact (VI:N/VA:N). The PR:L requirement is the key mitigating signal: an attacker needs valid credentials (any authenticated ERPNext account), which narrows the realistic threat to insiders, compromised accounts, or environments with weak/self-service registration. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or available exploit code at time of analysis - the risk is driven by the vulnerability's inherent exploitability, not observed activity. CWE-89 SQLi with confirmed confidentiality impact is realistically exploitable once an account is obtained, so prioritize patching for internet-exposed or multi-tenant ERPNext instances; single-tenant, trusted-user deployments behind authentication boundaries carry lower urgency. No conflicting signals were detected: the CVSS vector and the description (authenticated remote attacker extracting data) are consistent.

An attacker with any valid low-privileged ERPNext account (or one obtained via credential theft or open self-registration) sends a crafted request to one of the affected endpoints lacking input validation, injecting SQL that is concatenated into a backend query. The manipulated query returns data the account is not authorized to see - such as other tenants' records, financial data, or user credentials - enabling database exfiltration. No public exploit code was identified at time of analysis, and low attack complexity means a knowledgeable authenticated user could develop one readily.