CVE-2026-12895: ERPNext 0 to before 15.111.0, 0 to before 16.22.0

Affected technology

ERPNext · 0 to before 15.111.0, 0 to before 16.22.0
Frappe

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated user with low privileges could execute arbitrary SQL queries, bypass Frappe’s access restrictions (DocPerm), extract confidential information from the database—including fragments of the administrator’s password hash—and access other sensitive data, such as credentials, integration tokens, or financial information. Vendor/CNA’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity impact as none; availability impact as low.