CVE-2026-65822

This SQL injection in ERPNext's inactive customers report module is a case study in how developer workflow friction creates security shortcuts. The vulnerability lives in a report generator — a data aggregation tool that reads but doesn't write — and that functional framing appears to have lowered security scrutiny at exactly the wrong moment. An authenticated user can exploit the doctype filter parameter through raw string interpolation in get_sales_details and get_last_sales_amt functions, achieving lateral movement within the authenticated space to extract data the current user might not otherwise access. The critical action is not simply patching this file. The disclosure itself immediately expands the attack surface: every other ERPNext report module using the same doctype filter pattern is now a confirmed, accessible target because attackers now know exactly what this vulnerability class looks like in Frappe code. You must audit all report modules accepting doctype parameters — not just this one. The recurrence mechanism is structural, not accidental. Frappe's architecture incentivizes raw SQL in reporting contexts where developer convenience conflicts with parameterized query discipline. This specific mutation — doctype filter interpolation — has likely appeared in other report modules under different CVE numbers, been patched in those specific files, and reappeared because the institutional lesson was 'fix this file' rather than 'the framework makes this error structurally easy to commit.' Patching this instance will not break the sequence. Without framework-level changes that prevent raw SQL construction in reports entirely, the same genetic pattern will surface in whichever report module developers next perceive as operationally safe. Prioritize: audit all report modules using doctype filter parameters for similar interpolation patterns, then push for framework-level safeguards that throw errors on raw SQL in report contexts — the workflow cost is real, but it's the only way to eliminate this vulnerability class rather than chase it file-by-file.

Reviewed through automated stages and approved by a human before publication.