Frappe/ERPNext Week 33 2026 advisories: privilege escalation, SSTI, SQL injection and stored XSS

What happened

Frappe's Week 33 2026 advisory bundle covers ten flaws in ERPNext and the Frappe framework. The most severe, GHSA-x635-wr4c-7345, lets any authenticated user create records with permission checks disabled and thereby create privileged accounts and take over the site. GHSA-6w83-8777-v93q is server-side template injection; an authenticated user with a common operational role can read and write database records, delete documents, make outbound requests and send mail as the site.

Two stored cross-site scripting flaws, GHSA-8pr6-r75h-h8xx and GHSA-rg9g-c26v-cw27, allow account takeover by running script in a privileged user's browser. CVE-2026-66001 mishandles the OAuth2 consent flow so a user can be induced to approve a grant or reuse state for the wrong client. CVE-2026-65822 is SQL injection in the Inactive Customers report, GHSA-c496-q7g2-62vv allows record modification beyond the user's role, and CVE-2026-66002 permits user enumeration through a public form.

CVE-2026-62315 is mass assignment via set_value, and CVE-2026-63654 is a workflow-approval action submitted with a safe HTTP method. Neither has a released fixed version. None of the flaws are listed in CISA's Known Exploited Vulnerabilities catalogue, and the advisories do not report exploitation in the wild.

Who is affected

Affected products are ERPNext and the Frappe framework. ERPNext 15.x and 16.x builds are affected before the per-flaw fixed releases listed with this advisory; the individual fixed releases extend to 15.119.1 for the 15.x line and 16.32.0 for the 16.x line. Frappe framework versions are affected before 15.114.0 or 16.26.0 for the OAuth consent flaw, before 15.115.0 or 16.27.0 for user enumeration, and up to and including 16.31.0 for the mass-assignment and workflow-approval flaws.

What to do now

1. Upgrade ERPNext to the fixed releases named for your branch: 15.119.1 for 15.x and 16.32.0 for 16.x cover the fixed ERPNext flaws.
2. Upgrade the Frappe framework to 15.115.0 or 16.27.0 for the fixed framework flaws. CVE-2026-62315 and CVE-2026-63654 have no released fixed version.
3. Treat the unfixed flaws with containment: restrict access to the client and workflow endpoints, monitor for unexpected record or workflow changes, and watch for vendor guidance.
4. No vendor workaround is available for any of these flaws; upgrading is required where fixes exist.

How to detect it

Frappe has not published specific indicators of compromise for this bundle. Review logs for automated submissions to the personal data download request form (CVE-2026-66002), workflow approvals requested with safe HTTP methods such as GET (CVE-2026-63654), and Inactive Customers report queries containing unexpected doctype values (CVE-2026-65822).

Beyond the patch

This bundle shows why patching alone is not enough: low-privilege authenticated users, OAuth consent flows and portal pages are all viable paths to privilege escalation or account takeover. Managed Detection & Response (MDR) can catch the privilege escalation and record changes that follow; Implementation & Assessment Services can test an ERPNext or Frappe deployment and its exposed interfaces; and Supply Chain Defense & Third-Party Risk helps track how quickly vendors like Frappe ship fixes, because that timing defines your exposure window.