ERPNext and Frappe week 31 advisories: server-side template injection, SQL injection and access control flaws (CVE-2026-65974)

What happened

The most serious issue in this bundle is CVE-2026-65974, a server-side template injection in ERPNext. A limited authenticated user can reach frappe.render_template without restrict_globals, cross a permission boundary and achieve remote code execution over the network without any user interaction. It is rated critical with a 9.9 CVSS score.

Two SQL injection flaws affect ERPNext. CVE-2026-12895 lets a low-privileged authenticated user execute arbitrary SQL, bypass DocPerm and extract credentials, integration tokens or financial information, including fragments of the administrator's password hash. CVE-2026-72908 allows the same through the get_tax_template function.

The remaining flaws are access-control and permission-boundary issues in Frappe and ERPNext: CVE-2026-72907 allows creation of unauthorized accounting records; CVE-2026-66058 and CVE-2026-66059 allow unrestricted Document Follow actions and expose restricted DocType fields; CVE-2026-66000 lets users with revoked access keep receiving document data by email; and CVE-2026-47185 allows a private workspace to be modified with persistent script injection. None of the flaws are in CISA's KEV catalog, and no active exploitation or public disclosure is stated.

Who is affected

ERPNext: CVE-2026-65974 affects versions before 15.111.0 and >= 16.0.0, < 16.22.0. CVE-2026-12895 affects versions before 15.111.0 and before 16.22.0. CVE-2026-72908 affects before 15.109.0 and >= 16.0.0, < 16.20.0. CVE-2026-72907 affects before 15.111.0 and >= 16.0.0, < 16.22.0.

Frappe: CVE-2026-66058 and CVE-2026-66059 affect >= 16.0.0-beta.1, < 16.20.0 and before 15.112.0. CVE-2026-47185 affects before 16.18.0. CVE-2026-66000 affects >= 16.0.0-beta.1, < 16.19.0 and >= 15.0.0, < 15.109.0.

What to do now

1. Apply the vendor updates. Use ERPNext/Frappe 15.112.0 for 15.x and 16.23.0 for 16.x to cover this bundle. CVE-2026-65974 and CVE-2026-12895 are fixed in 15.111.0 and 16.22.0; CVE-2026-72908 is fixed in 15.109.0 and 16.20.0; CVE-2026-72907, CVE-2026-66058, CVE-2026-66059 and CVE-2026-66000 are fixed in 15.112.0 and 16.23.0; CVE-2026-47185 is fixed in Frappe 16.18.0.
2. No vendor workaround is published. Until patching is complete, restrict ERPNext and Frappe interfaces to trusted networks and trusted users, and minimise low-privileged account usage.
3. After patching, review accounting master data created by limited accounts and consider rotating credentials, database accounts and integration tokens because the SQL injection flaws can expose them if exploited.

How to detect it

Review application and database logs for unexpected calls to frappe.render_template, SQL errors involving Supplier record names or tax rule posting_date/args values, and creation of accounting records by accounts without create permission. In larger environments, EDR or SIEM monitoring should look for unusual code execution and database access from the ERPNext/Frappe service accounts.

Beyond the patch

A single low-privileged ERPNext account turning into code execution or bulk data access makes this more than a patch-timing issue. Managed Detection & Response detects the post-exploitation activity that follows RCE or credential abuse, and Supply Chain Defense & Third-Party Risk helps you track how quickly platforms you depend on publish fixes and where your exposure window sits.