CVE-2026-65822 frappe CVE debrief

Who should care

Defenders responsible for ERPNext installations, especially those with authenticated user access, should assess exposure and apply patches to prevent potential data extraction and query manipulation.

Why it matters

CVE-2026-65822 is a HIGH severity vulnerability in ERPNext that allows authenticated users to extract sensitive information and manipulate database queries. Defenders should prioritize verifying exposure and applying patches to prevent potential impacts.

• Potential data extraction by authenticated users
• Possible manipulation of database queries
• Need for verification of exposure and patch application
• Priority for updating ERPNext installations to fixed versions

Technical summary

The inactive_customers.py report in ERPNext accepts an unvalidated doctype filter, which is interpolated into raw SQL in get_sales_details and get_last_sales_amt. This allows an authenticated user to extract sensitive information and manipulate database queries. The issue is fixed in versions 15.116.0 and 16.23.0, and defenders should prioritize verifying exposure and applying patches to prevent potential data extraction and query manipulation. ERPNext installations, especially those with authenticated user access, are affected. Defenders should assess the vulnerability and apply patches to prevent potential impacts.

Defensive priority

Defenders should prioritize verifying exposure and applying patches for ERPNext installations, especially for authenticated users, to prevent potential data extraction and query manipulation.

Recommended defensive actions

• Verify ERPNext installations for version 15.116.0 or 16.23.0 or later
• Assess exposure for authenticated users
• Apply patches or updates as recommended by the vendor
• Monitor for potential data extraction and query manipulation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.6 and affected versions. However, specific details about exploitation or victim impact are not provided, suggesting a need for verification and cautious assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.