CVE-2026-109646: Frappe ERPNext SQL Injection Vulnerability

CVE-2026-109646 Overview

CVE-2026-109646 is a SQL injection vulnerability in Frappe ERPNext, an open-source enterprise resource planning platform. The flaw exists in multiple endpoints that fail to validate user-supplied input before passing it to database queries. Authenticated attackers with low-privileged accounts can inject SQL statements through crafted requests to extract sensitive data from the backend database. The issue affects ERPNext versions prior to 15.106.0 and 16.x versions before 16.16.0. The weakness is categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated low-privileged users can exfiltrate confidential database records across tenants, including financial, HR, and customer data stored in ERPNext.

Affected Products

Frappe ERPNext versions before 15.106.0
Frappe ERPNext 16.x versions before 16.16.0
Deployments exposing authenticated endpoints to internal or external users

Discovery Timeline

2026-10-12 - CVE-2026-109646 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109646

Vulnerability Analysis

The vulnerability resides in several ERPNext endpoints that accept parameters forwarded directly into SQL queries without sanitization. Because authentication is required, exploitation presumes an existing low-privileged account such as a standard employee or portal user. Once authenticated, an attacker constructs query parameters containing SQL fragments that alter the structure of server-side queries. The injected statements run with the privileges of the ERPNext database user, which generally has broad read access across tenant tables.

Successful exploitation enables confidentiality impact across the database, including customer records, financial documents, employee details, and configuration data. The advisory indicates no direct integrity or availability impact, but data disclosure alone can expose business and personal information covered by regulatory controls.

Root Cause

The root cause is missing input validation on parameters consumed by database query builders in specific ERPNext endpoints. Instead of parameterized queries or strict allowlists, affected code paths concatenate attacker-controlled strings into SQL. This pattern is the classic [CWE-89] weakness and bypasses the ORM protections used elsewhere in the Frappe framework.

Attack Vector

The attack vector is network-based and requires authentication with low privileges. An attacker sends an HTTP request to a vulnerable endpoint and includes SQL metacharacters inside a parameter that reaches the database layer unescaped. See the Frappe GitHub Security Advisory GHSA-pf6r-r324-94jj and the VulnCheck SQL Injection Advisory for endpoint specifics.

No verified public exploit code is available at this time. Readers should consult the security advisory for technical specifics rather than infer payloads from this article.

Detection Methods for CVE-2026-109646

Indicators of Compromise

HTTP requests to ERPNext endpoints containing SQL metacharacters such as single quotes, UNION SELECT, --, or /* in query parameters
Database query logs showing unusually long or malformed statements originating from the ERPNext application user
Unexpected SELECT activity against sensitive tables such as tabUser, tabCustomer, or tabSalary Slip from low-privileged sessions
Spikes in response size or latency from endpoints that normally return small, bounded datasets

Detection Strategies

Enable MariaDB or PostgreSQL general query logging and alert on queries containing boolean-based or union-based injection patterns
Deploy a web application firewall rule set that inspects authenticated ERPNext traffic for SQL injection signatures
Correlate authentication events with abnormal query volume per user to identify low-privileged accounts probing the database

Monitoring Recommendations

Forward ERPNext application logs and database audit logs to a centralized SIEM for retention and correlation
Baseline normal API usage per role and alert on deviations such as new endpoints being accessed by portal users
Review Frappe audit trail entries for unusual export, report, or search activity following suspected probing

How to Mitigate CVE-2026-109646

Immediate Actions Required

Upgrade Frappe ERPNext to version 15.106.0 or later on the 15.x branch
Upgrade Frappe ERPNext to version 16.16.0 or later on the 16.x branch
Audit existing user accounts and revoke unused low-privileged credentials that could be leveraged for exploitation
Rotate database credentials and API keys if exploitation is suspected

Patch Information

The maintainers released fixes in ERPNext 15.106.0 and 16.16.0. The patches add input validation to the affected endpoints. Refer to the GitHub Security Advisory GHSA-pf6r-r324-94jj for the complete patch list and upgrade guidance.

Workarounds

Restrict network access to ERPNext instances using IP allowlists or VPN gating where feasible
Enforce least privilege on ERPNext roles and remove API access from accounts that do not require it
Place a web application firewall in front of ERPNext with SQL injection rules tuned for authenticated traffic

bash

# Upgrade ERPNext using the bench CLI
bench update --reset
bench switch-to-branch version-15 erpnext --upgrade
bench --site your-site.local migrate
bench restart