{"id":"CVE-2026-109608","published":"2026-10-12T23:17:24.497","lastModified":"2026-10-15T15:17:25.890","description":"Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v","tags":[]},{"url":"https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-sql-injection-via-unvalidated-endpoint-input","tags":[]}],"exploitRefs":[{"url":"https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v","tags":[]}],"hasPoc":true,"ai":{"summary":"An SQL injection vulnerability in Frappe ERPNext allows authenticated users to access sensitive data from other users and escalate privileges. This affects versions before 15.121.0 and 16.x before 16.34.0.","exploitability":"The vulnerability is easily exploitable by any authenticated user with minimal prerequisites, requiring only valid credentials to send crafted requests that bypass input validation.","blast_radius":"The impact could be significant across an organization as attackers can read sensitive user data and potentially escalate to privileged accounts, affecting multiple users' information and system access.","remediation":"Upgrade to ERPNext version 15.121.0 or 16.34.0 to remediate the SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","privilege-escalation","web-application"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:02:22.172Z"}}