CVE-2026-72908: ERPNext SQL Injection Vulnerability

CVE-2026-72908 Overview

CVE-2026-72908 is a SQL injection vulnerability in ERPNext, a free and open-source Enterprise Resource Planning platform maintained by Frappe. The flaw resides in the get_tax_template function within erpnext/accounts/doctype/tax_rule/tax_rule.py. This function constructs a SQL WHERE clause from request-influenced posting_date and args values without proper sanitization. An authenticated low-privilege user can inject SQL syntax and extract sensitive information from the underlying database. The issue is fixed in ERPNext versions 15.109.0 and 16.20.0. The vulnerability maps to CWE-89: Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated low-privilege users can exfiltrate sensitive database contents through SQL injection in the tax rule template resolution logic.

Affected Products

ERPNext versions prior to 15.109.0 (15.x branch)
ERPNext versions prior to 16.20.0 (16.x branch)
Deployments exposing the get_tax_template endpoint to authenticated users

Discovery Timeline

2026-08-10 - CVE-2026-72908 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72908

Vulnerability Analysis

The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py builds a raw SQL WHERE clause using values controllable through the incoming request. Both the posting_date parameter and entries in the args dictionary are concatenated into the query string, bypassing parameterized query protections. Any authenticated user with permission to invoke the tax rule lookup can supply crafted values that alter the intended query structure. Successful exploitation returns database contents beyond the caller's authorization scope, including data from unrelated tables through techniques such as UNION SELECT payloads. Because ERPNext stores financial, customer, and supplier records in the same database, the exposure extends to sensitive accounting and personally identifiable information.

Root Cause

The root cause is string concatenation of untrusted input into SQL statements rather than the use of parameter binding. The upstream fix, delivered in pull request #55127, rewrites get_tax_template using the Frappe query_builder abstraction and its DocType and IfNull helpers. This shifts the code away from raw SQL assembly toward a typed builder that escapes and binds values consistently.

Attack Vector

Exploitation requires network access to the ERPNext application and valid authenticated credentials at a low privilege level. No user interaction is needed once the attacker holds a session. The attacker submits a request that reaches get_tax_template with SQL metacharacters embedded in posting_date or args. The manipulated clause is executed by the database engine and results are returned in the application response, enabling data extraction.

python

# Excerpt from the security patch (Source: https://github.com/frappe/erpnext/commit/2a91c7229a47ac6a5bb2d8227290b03415bf8baf)
 from frappe import _
 from frappe.contacts.doctype.address.address import get_default_address
 from frappe.model.document import Document
+from frappe.query_builder import DocType
+from frappe.query_builder.functions import IfNull
 from frappe.utils import cstr
 from frappe.utils.nestedset import get_root_of

 from erpnext.setup.doctype.customer_group.customer_group import get_parent_customer_groups
+from erpnext.setup.doctype.supplier_group.supplier_group import get_parent_supplier_groups


 class IncorrectCustomerGroup(frappe.ValidationError):

The patch introduces the Frappe query builder so that WHERE conditions are composed through safe APIs rather than string interpolation. See the full patch commit for the complete rewrite of get_tax_template.

Detection Methods for CVE-2026-72908

Indicators of Compromise

Application or database logs containing SQL metacharacters (', --, UNION, SELECT, /*) within posting_date or args values sent to tax rule endpoints.
Unexpected HTTP requests to the tax rule resolution API originating from low-privilege user sessions.
Anomalous database queries referencing tables outside the tax rule scope, such as tabUser, tabCustomer, or tabSupplier.

Detection Strategies

Enable Frappe framework verbose SQL logging and inspect queries generated from get_tax_template for unbound string concatenation.
Deploy a web application firewall (WAF) rule set that flags SQL injection payloads in POST bodies targeting /api/method/erpnext.accounts.doctype.tax_rule.tax_rule.get_tax_template.
Correlate authentication events with sudden spikes in query volume or query result size per user session.

Monitoring Recommendations

Alert on database error responses (syntax errors, cast failures) generated by tax rule endpoints, which often accompany injection probing.
Track outbound response sizes from ERPNext API endpoints and investigate significant deviations for low-privilege accounts.
Retain reverse proxy access logs for at least 90 days to support retrospective hunting once patches are applied.

How to Mitigate CVE-2026-72908

Immediate Actions Required

Upgrade ERPNext to version 15.109.0 on the 15.x branch or 16.20.0 on the 16.x branch without delay.
Audit user roles and revoke tax rule read or write access from accounts that do not require it.
Review recent database activity for signs of unauthorized data access originating from low-privilege sessions.

Patch Information

The fix is delivered through pull request #55127 and shipped in ERPNext v15.109.0 and ERPNext v16.20.0. The relevant commits are 2a91c72, c45d2a3, and f98975f. Refer to the GitHub Security Advisory GHSA-grhp-m55m-63f8 for the coordinated disclosure record.

Workarounds

Restrict network access to the ERPNext application so only trusted users and networks can reach tax rule endpoints.
Deploy WAF signatures that block SQL injection patterns against get_tax_template request parameters until patching completes.
Temporarily remove tax rule permissions from non-administrative roles to reduce the pool of accounts that can trigger the vulnerable code path.

bash

# Upgrade ERPNext using the bench CLI to a patched release
bench switch-to-branch version-15 erpnext --upgrade
bench update --reset
bench --site all migrate
# Verify the installed version is >= 15.109.0 or >= 16.20.0
bench version