SQL injection in ERPNext - #VU163028
Published: November 9, 2026
Vulnerability identifier: #VU163028
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user with no assigned roles to extract sensitive database information, including active session data that enables administrator account takeover.
The vulnerability exists due to missing validation after caller-supplied data overrides a validated request value in ERPNext's Selling and Buying modules. An authenticated user with no assigned roles can send a specially crafted request to inject SQL into the endpoint's database query without victim interaction.
Affected software
ERPNext
Remediation
Install security update from vendor's website.
ERPNext - addressed in versions 15.121.6, 16.37.0