Frappe ERPNext SQL injection lets any authenticated user escalate to a privileged account (CVE-2026-109608)

What happened

Frappe ERPNext has SQL injection in several endpoints that lack input validation. An attacker who can authenticate to the application, even with no assigned roles, can send specially crafted requests to those endpoints. The flaw is reachable over the network with low attack complexity and no user interaction, so any valid account is enough to exploit it.

The injection can be used to read other users' sensitive information and escalate to a privileged account. The CVSS 4.0 score is 8.7, high severity, with high impact on confidentiality, integrity and availability within the ERPNext instance.

The CVE record does not state exploitation, and CISA's KEV catalogue does not list this vulnerability.

Who is affected

Affected versions are erpnext before 15.121.0 and erpnext from 16.0.0-beta.1 to before 16.34.0. Because ERPNext typically holds sensitive business records, this matters to any deployment where an attacker can obtain even a low-privilege account with no assigned roles. Installations on the affected branches should be treated as affected regardless of how they are hosted.

What to do now

1. Patch. Upgrade affected installations to erpnext 15.121.0 on the 15 branch or erpnext 16.34.0 on the 16 branch. These are the fixed versions named in the advisory.
2. If patching must be deferred, reduce exposure by restricting network access to the application to trusted users and networks. The vulnerability requires a valid authenticated session, so limiting who can reach the application and reviewing account creation reduces near-term risk.
3. After updating, review accounts and privileges for any new privileged accounts or unexpected role assignments created before the patch.

No workaround has been published.

Beyond the patch

This is a reminder that authenticated access does not mean trusted access: a low-privilege account was enough for an SQL injection to read sensitive data and escalate. A penetration test and hardening review can find exactly this kind of unvalidated-endpoint flaw before someone else does, while tracking how quickly upstream ERPNext releases are patched and adopted is how you avoid long exposure windows. Implementation & Assessment Services covers the testing and hardening, and Supply Chain Defense & Third-Party Risk helps you track supplier patch cycles and the versions you run.