CVE-2026-109608

{
  "etk_id": "ETK-2026-1429",
  "cve_id": "CVE-2026-109608",
  "display_id": "CVE-2026-109608",
  "ghsa_id": "GHSA-59gg-p7mc-h3g6",
  "euvd_id": "EUVD-2026-98002",
  "status": "published",
  "anchor_state": "anchored",
  "title": "SQL injection in Frappe ERPNext endpoints",
  "summary": "ERPNext versions earlier than 15.121.0 and 16.34.0 contain SQL injection flaws in multiple request endpoints. An attacker who can log in, even without assigned roles, may access other users' sensitive data and obtain higher privileges.",
  "mitigation": "Upgrade ERPNext 15.x to 15.121.0 or later, or ERPNext 16.x to 16.34.0 or later. Until upgraded, restrict access to authenticated accounts and review accounts for unexpected privilege changes.",
  "vendor": "frappe",
  "product": "erpnext",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 15.121.0"
      ],
      "ecosystem": "frappe",
      "fixed_versions": [
        "15.121.0"
      ],
      "package_name": "erpnext",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 16.34.0"
      ],
      "ecosystem": "frappe",
      "fixed_versions": [
        "16.34.0"
      ],
      "package_name": "erpnext",
      "purl": null
    }
  ],
  "cwes": [
    89
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.1583,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 61.80411175,
  "t0_at": "2026-10-12T22:21:57.198000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-12T23:57:02.422514+00:00",
      "days": 0.06603269113425926,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T22:21:57.198000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-12T22:21:57.198000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T22:21:57.198000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-109608"
    }
  }
}