SQL injection in ERPNext - CVE-2026-109626
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU163027
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-109626
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated remote attacker with low privileges to extract sensitive information from ERPNext through SQL injection without victim interaction.
The vulnerability exists due to missing validation of request input in affected ERPNext endpoints when specially crafted requests are processed. An authenticated remote attacker with low privileges can submit these requests to inject SQL commands and retrieve sensitive information.
Affected software
ERPNext
How to mitigate CVE-2026-109626
Install security update from vendor's website.
ERPNext - update to 16.34.2