CVE-2026-72908 frappe CVE debrief

Who should care

Defenders responsible for ERPNext deployments, especially those with low-privilege users, should assess exposure and prioritize remediation or compensating controls. This includes reviewing and updating access controls for ERPNext users, verifying exposure in managed environments, and planning vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-72908 is a SQL injection vulnerability in ERPNext that allows low-privilege users to extract sensitive information. Defenders should prioritize verifying exposure, assessing compensating controls, and upgrading to fixed versions.

• Defenders must verify exposure in ERPNext deployments, especially for low-privilege users.
• Potential SQL injection attempts require monitoring and detection.
• Upgrading to versions 15.109.0 or 16.20.0, or later, is necessary to fix the issue.
• Reviewing and updating access controls for ERPNext users is essential.

Technical summary

The get_tax_template function in erpnext/accounts/doctype/tax_rule/tax_rule.py constructs an SQL WHERE clause from request-influenced posting_date and args values, allowing an authenticated low-privilege user to inject SQL and extract sensitive information. This issue arises in ERPNext versions prior to 15.109.0 and 16.20.0, where the function improperly handles user input, leading to potential SQL injection attacks. Defenders should focus on verifying exposure in ERPNext deployments, especially for low-privilege users, and assess the need for compensating controls or monitoring to detect potential SQL injection attempts.

Defensive priority

Defenders should prioritize verifying exposure in ERPNext deployments, especially for low-privilege users, and assess the need for compensating controls or monitoring to detect potential SQL injection attempts.

Recommended defensive actions

• Verify ERPNext deployments for exposure, especially for low-privilege users.
• Assess the need for compensating controls or monitoring to detect potential SQL injection attempts.
• Prioritize upgrading to versions 15.109.0 or 16.20.0, or later.
• Review and update access controls for ERPNext users.
• Confirm whether affected ERPNext deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish versions, exploitation, impact, or remediation beyond vendor-provided information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.