SB20261109177 - SQL injection in ERPNext

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109177

SB20261109177 - SQL injection in ERPNext

Published: November 9, 2026

Security Bulletin ID SB20261109177
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated user with no assigned roles to extract sensitive database information, including active session data that enables administrator account takeover.

The vulnerability exists due to missing validation after caller-supplied data overrides a validated request value in ERPNext's Selling and Buying modules. An authenticated user with no assigned roles can send a specially crafted request to inject SQL into the endpoint's database query without victim interaction.


Remediation

Install update from vendor's website.

References