CVE-2026-114664 frappe CVE debrief

Who should care

Defenders of Frappe installations should assess exposure and prioritize remediation. This includes administrators, security teams, and IT personnel responsible for maintaining Frappe installations. They should review and update Frappe installations to version 16.33.0 or later, restrict access to the get_events method, and monitor for suspicious activity. Additionally, they should verify Frappe version and restrict access to get_events method as a prevent

Why it matters

CVE-2026-114664 is a blind SQL injection vulnerability in Frappe before 16.33.0 that allows authenticated attackers to extract sensitive database information. Defenders should assess exposure, prioritize remediation, and restrict access to the get_events method.

• Authenticated attackers can extract sensitive database information
• Defenders must verify Frappe version and restrict access to get_events method

Technical summary

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method. This vulnerability allows authenticated attackers to extract sensitive database information by sending crafted input to the get_events method. The vulnerability is caused by the lack of proper input neutralization in the get_events method, which enables attackers to infer query results from application behavior. Defenders should assess exposure and prioritize remediation to prevent potential data breaches.

Defensive priority

Authenticated attackers can exploit this vulnerability to extract sensitive database information.

Recommended defensive actions

• Review and update Frappe installations to version 16.33.0 or later
• Restrict access to the get_events method
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the blind SQL injection vulnerability in Frappe before 16.33.0. The vulnerability is located in the frappe.desk.doctype.event.event.get_events method. Authenticated attackers can exploit this vulnerability to extract sensitive database information. The source item and CVE record do not provide explicit evidence of exploitation, but defenders should verify Frappe version and restrict access to get_events method as a precautionary measure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.