VYPR
patchPublished Oct 12, 2026· Updated Oct 13, 2026· 1 source

Frappe ERPNext: 25 Vulnerabilities Including SQLi, XSS, and Auth Bypass Disclosed Together

Key findings • 25 vulnerabilities disclosed for Frappe ERPNext on October 12, 2026, impacting versions prior to 15.119.1 and 16.x before 16.32.0. • Key vulnerability types include missing aut…

Key findings

  • 25 vulnerabilities disclosed for Frappe ERPNext on October 12, 2026, impacting versions prior to 15.119.1 and 16.x before 16.32.0.
  • Key vulnerability types include missing authorization, SQL injection, stored XSS, privilege escalation, SSTI, and SSRF.
  • Multiple CVEs detail missing authorization flaws allowing unauthorized access to sensitive financial, personal, inventory, and production data.
  • Stored XSS vulnerabilities (CVE-2026-109673, CVE-2026-109671, CVE-2026-109670, CVE-2026-109663, CVE-2026-109657, CVE-2026-109653) enable script execution in user browsers.
  • High-severity flaws include privilege escalation (CVE-2026-109667) and server-side template injection (CVE-2026-109652).
  • Prompt updates to patched versions are critical to mitigate these widespread security risks.

On October 12, 2026, a significant batch of 25 vulnerabilities was disclosed for Frappe ERPNext, affecting versions prior to 15.119.1 and 16.x before 16.32.0. These vulnerabilities, ranging in severity from Medium to High, were all disclosed on the same day, indicating a coordinated disclosure event. The issues primarily revolve around missing authorization checks, SQL injection, cross-site scripting (XSS), and server-side template injection (SSTI), posing a considerable risk to data integrity and user security within ERPNext instances.

A notable cluster of vulnerabilities pertains to missing authorization checks, with CVE-2026-109672, CVE-2026-109669, CVE-2026-109668, CVE-2026-109666, CVE-2026-109665, CVE-2026-109664, CVE-2026-109661, CVE-2026-109660, CVE-2026-109659, CVE-2026-109658, CVE-2026-109656, CVE-2026-109655, and CVE-2026-109650 all stemming from insufficient authorization enforcement in various endpoints. These flaws allow authenticated users, often with low privileges, to access or modify data beyond their intended roles, including sensitive financial and personal information, as well as inventory and production records.

Cross-site scripting (XSS) vulnerabilities are also a significant concern, with CVE-2026-109673, CVE-2026-109671, CVE-2026-109670, CVE-2026-109663, and CVE-2026-109657 allowing attackers to inject malicious scripts. These scripts can execute in the browsers of other users, including administrators, when certain records or profile fields are rendered without proper sanitization. CVE-2026-109663 specifically affects a public portal form, potentially allowing unauthenticated attackers to inject harmful markup. CVE-2026-109653, a high-severity stored XSS vulnerability, allows low-privilege users to inject payloads into record fields, which can then be executed by privileged users.

SQL injection vulnerabilities, detailed in CVE-2026-109674 and CVE-2026-109663, arise from missing input validation in certain endpoints. These flaws permit authenticated attackers to manipulate database queries, potentially leading to sensitive data exfiltration.

Furthermore, critical vulnerabilities such as privilege escalation (CVE-2026-109667) and server-side template injection (SSTI) (CVE-2026-109652) were disclosed. CVE-2026-109667 allows any authenticated user to escalate their privileges by exploiting a record-creation endpoint that bypasses permission checks. CVE-2026-109652 enables authenticated attackers with common roles to inject and execute expressions within the server's template rendering process. A server-side request forgery (SSRF) vulnerability, CVE-2026-109651, allows authenticated attackers to force the application to make arbitrary outbound requests.

The affected versions for these vulnerabilities are specific: versions prior to 15.98.0, 15.103.0, 15.118.0, 15.113.0, 15.110.0, 15.111.0, 15.108.0, 15.112.0, 15.113.0, 15.115.0, 15.118.2, 15.119.0, 15.119.1 for the 15.x branch, and versions prior to 16.6.0, 16.12.0, 16.27.0, 16.24.0, 16.21.0, 16.22.0, 16.18.0, 16.23.0, 16.27.0, 16.30.0, 16.26.0, 16.31.0, 16.32.0 for the 16.x branch. Users are strongly advised to update to the patched versions to mitigate these risks.

This extensive batch of vulnerabilities underscores the importance of regular security audits and prompt patching for Frappe ERPNext instances. The wide range of issues, from data leakage via authorization bypass to code execution via XSS and SSTI, presents a multifaceted threat landscape. Organizations using ERPNext should prioritize updating their systems to the latest secure versions to protect sensitive business data and maintain operational integrity. The coordinated disclosure of these flaws highlights a proactive security stance by the researchers or the vendor, providing users with the necessary information to address these critical security gaps.

Synthesized by Vypr AI