CVE-2026-109647: Frappe ERPNext SQL Injection Vulnerability

CVE-2026-109647 is an SQL injection vulnerability in Frappe ERPNext affecting versions before 15.106.0 and 16.x before 16.16.0. Authenticated attackers can exploit this flaw to extract sensitive database information. This article covers technical details, affected versions, impact, and mitigation strategies.

CVE-2026-109647 Overview

CVE-2026-109647 is a SQL injection vulnerability in Frappe ERPNext, an open-source enterprise resource planning platform. The flaw stems from missing input validation across multiple HTTP endpoints. Authenticated attackers can send crafted requests to manipulate backend database queries and extract sensitive data stored in the ERPNext database. The vulnerability affects Frappe ERPNext versions before 15.106.0 and 16.x releases before 16.16.0. The weakness is classified under CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated attackers can exfiltrate arbitrary data from the ERPNext database, including financial records, customer information, and credentials, by injecting SQL payloads into vulnerable endpoints.

Affected Products

Frappe ERPNext versions prior to 15.106.0
Frappe ERPNext 16.x versions prior to 16.16.0
Deployments exposing authenticated ERPNext endpoints over the network

Discovery Timeline

2026-10-12 - CVE-2026-109647 published to the National Vulnerability Database
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109647

Vulnerability Analysis

The vulnerability resides in multiple ERPNext HTTP endpoints that accept user-supplied parameters and incorporate them into SQL queries without proper sanitization. An authenticated attacker with low privileges can submit crafted parameter values that break out of the intended query context. The injected SQL executes with the privileges of the ERPNext database user, which typically has read access to the entire application schema. Successful exploitation leads to unauthorized disclosure of database contents, including business records, user profiles, and application secrets.

The network attack vector and low attack complexity make exploitation straightforward for any user with a valid ERPNext account. According to the published EPSS data, this issue has a modest near-term exploitation probability, but authenticated SQL injection in enterprise applications is routinely weaponized post-compromise.

Root Cause

The root cause is missing input validation and the absence of parameterized queries in the affected endpoints. User input is concatenated directly into SQL statements, allowing attackers to append arbitrary query fragments. The flaw maps to CWE-89, SQL Injection.

Attack Vector

An attacker authenticates to the ERPNext instance using any valid account, including low-privileged users. The attacker then sends an HTTP request to one of the affected endpoints with a crafted parameter value. The payload modifies the resulting SQL query to return or exfiltrate data outside the user's intended authorization scope. No user interaction from an administrator is required.

For technical specifics, refer to the GitHub Security Advisory GHSA-h68p-2phh-vh26 and the VulnCheck SQL Injection Advisory.

Detection Methods for CVE-2026-109647

Indicators of Compromise

HTTP requests to ERPNext endpoints containing SQL metacharacters such as ', --, UNION SELECT, SLEEP(, or INFORMATION_SCHEMA in query parameters
Unusually long parameter values or encoded payloads in authenticated API calls
Database error messages returned in HTTP responses from /api/method/ paths
Spikes in query latency or query volume originating from a single authenticated session

Detection Strategies

Deploy a web application firewall rule set that inspects authenticated ERPNext API traffic for SQL injection patterns
Enable MariaDB or PostgreSQL query logging and alert on queries containing suspicious union operations against application tables
Correlate authenticated session identifiers with anomalous query patterns in ERPNext application logs

Monitoring Recommendations

Monitor ERPNext access logs for repeated 500-series errors from a single user session
Alert on outbound data transfers from the ERPNext application server that exceed baseline volumes
Track low-privileged accounts issuing requests to administrative or reporting endpoints

How to Mitigate CVE-2026-109647

Immediate Actions Required

Upgrade Frappe ERPNext to version 15.106.0 or later on the 15.x branch
Upgrade Frappe ERPNext to version 16.16.0 or later on the 16.x branch
Audit ERPNext user accounts and revoke sessions for any account showing anomalous query activity
Review database audit logs for signs of unauthorized SELECT statements against sensitive tables

Patch Information

Frappe has released fixed builds in ERPNext 15.106.0 and 16.16.0. The patched versions add input validation and parameterized query handling for the affected endpoints. Patch details are available in the GitHub Security Advisory GHSA-h68p-2phh-vh26.

Workarounds

Restrict network access to the ERPNext instance to trusted IP ranges using a reverse proxy or firewall
Enforce multi-factor authentication on all ERPNext user accounts to reduce the pool of attackers that can reach authenticated endpoints
Apply least-privilege configuration to the ERPNext database user where supported by the deployment
Deploy a WAF profile that blocks SQL injection signatures on paths under /api/method/

bash

# Example upgrade commands using the bench CLI
bench update --patch
bench version --format table
bench --site <site-name> migrate