CVE-2026-109631

Name of the Vulnerable Software and Affected Versions Frappe ERPNext versions prior to 15.119.1 Frappe ERPNext versions 16.x prior to 16.32.0

Description An SQL injection issue exists due to insufficient input validation in certain endpoints. This allows authenticated attackers with low privileges to send specially crafted requests to alter database queries and extract sensitive information from the database. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data.

Recommendations Update to version 15.119.1 or later. Update to version 16.32.0 or later.