High priorityDisclosed

Advisory · CVE-2026-109608

SQL injection in ERPNext endpoints allows privilege escalation

ERPNext before 15.121.0 and 16.x before 16.34.0 has SQL injection in several endpoints lacking input validation, letting any authenticated user read sensitive information and escalate to a privileged account. CVSS 3.1 8.8.

Advisory published October 13, 2026Independent summary
Vendor
Frappe
Product
ERPNext
Identifier / CWE
CVE-2026-109608
CWE-89
Action timing
Immediate
ELI5

Explain it like I’m five

Several ERPNext endpoints trust what users type, so any signed-in user can inject SQL and read their way up to a privileged account.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Any account

    An authenticated attacker, even one with no assigned roles, reaches the affected endpoints.

  2. 02Injected input

    The endpoints lack input validation, so the attacker's input becomes SQL.

  3. 03Read and escalate

    The attacker reads other users' sensitive information and escalates to a privileged account.

What happened

The Frappe project disclosed CVE-2026-109608 for ERPNext before 15.121.0 and 16.x before 16.34.0. Several endpoints lack input validation and are vulnerable to SQL injection (CWE-89). Any authenticated user, including one with no assigned roles, can read other users’ sensitive information and escalate to a privileged account.

Per the vendor’s affected data, upgrade to 15.121.0 or 16.34.0 or later for the respective lines.

What to do

  1. Inventory every ERPNext deployment, including test, training, and individually managed instances.
  2. Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
  3. Restrict network access to ERPNext while remediation is underway, especially for internet-facing instances.
  4. Review application and server logs for SQL errors and injection patterns in ERPNext request logs, bulk reads of user tables, and unexpected role grants.
  5. Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
  6. Verify the deployed version or patch level after remediation.

Management note

ERPNext holds the whole business: invoices, payroll, inventory. An any-user SQL injection is a full-database event until proven otherwise.