---
id: CVE-2026-109608
title: >-
  Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL
  injection vulnerability in several endpoints that lack input validation
summary: >-
  Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL
  injection vulnerability in several endpoints that lack input validation. Any
  authenticated user, including one with no assigned roles, can send specially
  crafted requ…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-89
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:24.617'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109608'
references:
  - url: 'https://github.com/frappe/erpnext/security/advisories/GHSA-v38v-9h2p-hr8v'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-erpnext-before-15.121.0-sql-injection-via-unvalidated-endpoint-input
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.616Z'
---

## Overview

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate to a privileged account.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.