Frappe ERPNext SQL injection allows any authenticated user to read sensitive information and escalate privileges (CVE-2026-109608)

What happened

The CVE record describes CWE-89 SQL injection in several ERPNext endpoints that do not validate input. The flaw is reachable over the network with low attack complexity and no user interaction. Only low privileges are required, and the CVE record states that any authenticated user, including one with no assigned roles, can send specially crafted requests.

A successful attacker can read other users' sensitive information and escalate to a privileged account. The CVSS 4.0 score is 8.7 high: high impact to confidentiality, integrity and availability of the ERPNext instance itself, with no impact on subsequent systems.

No exploitation or public disclosure is reported in the CVE record, and it is not listed in CISA's KEV.

Who is affected

ERPNext installations are affected in these ranges: all releases before 15.121.0, and 16.0.0-beta.1 through versions before 16.34.0. If you run any 15.x release older than 15.121.0, or any 16.0.0-beta.1 and later 16.x release older than 16.34.0, this applies to you. The flaw is reachable by any authenticated user, including accounts with no assigned roles, so internet-facing or shared-user ERPNext deployments are the highest exposure.

What to do now

1. Upgrade to the fixed release: ERPNext 15.121.0 for 15.x deployments, or ERPNext 16.34.0 for 16.x deployments.
2. No workaround is listed in the CVE record or the GitHub advisory. Until the upgrade is applied, restrict network access to ERPNext so only trusted users and administrative networks can reach it, and review user provisioning to remove unnecessary accounts.
3. After patching, review privileged account activity as a precaution, since the vulnerability can be used to escalate to a privileged account.

How to detect it

No indicators of compromise are published in the CVE record or the GitHub advisory. Treat high-risk signals as authenticated activity from accounts with no assigned roles that reads or changes other users' information, and review application access logs for crafted or unusual requests to ERPNext endpoints.

Beyond the patch

An ERP platform holds financial, inventory and employee data, so a low-privilege SQL injection that escalates to privileged access is a reason to look for the next input-validation gap before an advisory finds it. Implementation & Assessment Services include penetration testing and hardening that find injection and authentication flaws directly. Because the fix window depends on tracking an open-source component and its patch cycle, Supply Chain Defense & Third-Party Risk helps keep ERPNext versions and supplier patch timing visible.