CVE-2026-65822: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext
CVE-2026-65822 is a high severity SQL Injection vulnerability in ERPNext, an open source ERP tool. Versions prior to 15.116.0 and 16.23.0 contain a flaw in the inactive_customers report module where an unvalidated doctype filter is interpolated directly into SQL queries. This allows an authenticated user to extract sensitive data and manipulate database queries. The issue is fixed in versions 15.116.0 and 16.23.0.
AI Analysis
Technical Summary
ERPNext versions before 15.116.0 and 16.23.0 have an SQL Injection vulnerability in the erpnext/selling/report/inactive_customers/inactive_customers.py file. The vulnerability arises because the doctype filter parameter is not validated and is directly interpolated into raw SQL statements in the functions get_sales_details and get_last_sales_amt. This improper neutralization of special elements in SQL commands (CWE-89) can be exploited by an authenticated user to access sensitive information and manipulate database queries. The vulnerability is addressed in ERPNext versions 15.116.0 and 16.23.0.
Potential Impact
An authenticated user can exploit this vulnerability to extract sensitive information from the database and manipulate SQL queries, potentially leading to unauthorized data disclosure and partial integrity and availability impacts. The CVSS v3.1 score is 7.6 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity and availability impact.
Mitigation Recommendations
This vulnerability is fixed in ERPNext versions 15.116.0 and 16.23.0. Users should upgrade to at least these versions to remediate the issue. No other mitigation guidance is provided. Patch status is confirmed fixed in these versions.
CVE-2026-65822: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in frappe erpnext
Description
CVE-2026-65822 is a high severity SQL Injection vulnerability in ERPNext, an open source ERP tool. Versions prior to 15.116.0 and 16.23.0 contain a flaw in the inactive_customers report module where an unvalidated doctype filter is interpolated directly into SQL queries. This allows an authenticated user to extract sensitive data and manipulate database queries. The issue is fixed in versions 15.116.0 and 16.23.0.
CVSS v3.1
Score 7.6high
Affected software
pkg:github/frappe/erpnextRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
ERPNext versions before 15.116.0 and 16.23.0 have an SQL Injection vulnerability in the erpnext/selling/report/inactive_customers/inactive_customers.py file. The vulnerability arises because the doctype filter parameter is not validated and is directly interpolated into raw SQL statements in the functions get_sales_details and get_last_sales_amt. This improper neutralization of special elements in SQL commands (CWE-89) can be exploited by an authenticated user to access sensitive information and manipulate database queries. The vulnerability is addressed in ERPNext versions 15.116.0 and 16.23.0.
Potential Impact
An authenticated user can exploit this vulnerability to extract sensitive information from the database and manipulate SQL queries, potentially leading to unauthorized data disclosure and partial integrity and availability impacts. The CVSS v3.1 score is 7.6 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact with limited integrity and availability impact.
Mitigation Recommendations
This vulnerability is fixed in ERPNext versions 15.116.0 and 16.23.0. Users should upgrade to at least these versions to remediate the issue. No other mitigation guidance is provided. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-22T23:16:47.752Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a83758abf8831d5398e091d
Added to database: 08/17/2026, 20:56:42 UTC
Last enriched: 08/17/2026, 21:11:20 UTC
Last updated: 08/18/2026, 02:18:50 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.