Executive brief
ERPNext is an open-source Enterprise Resource Planning (ERP) platform used by businesses to manage accounting, inventory, and operations. A security flaw in certain system endpoints allows an attacker to perform unauthorized database queries. This could lead to the theft of sensitive business data, modification of records, or a complete takeover of the application database.
Technical details
A SQL injection vulnerability (CWE-89) exists in ERPNext due to improper neutralization of user-supplied input in specific endpoints. An authenticated attacker with low-level privileges can send specially crafted network requests to execute arbitrary SQL commands against the backend database. This flaw allows for the extraction of sensitive information, unauthorized data modification, and potential impact on system availability. The vulnerability is fixed in versions 15.104.3 and 16.14.0; no workarounds are available other than upgrading.
Affected products
- Frappe ERPNext < 15.104.3, < 16.14.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: CVE published to NVD