CVE-2026-12895

CVE-2026-12895 is a SQL injection vulnerability in Frappe/ERPNext that warrants attention beyond its 7.1 CVSS score. The flaw allows authenticated users to inject SQL through data layer fields—specifically entity names like Supplier, Customer, and Employee—which then executes in the context of supposedly restricted queries. This is not a traditional SQL injection in user input; it's an injection through what the framework treats as trusted metadata, and that's precisely what makes it dangerous. The architectural severity lies in what this does to DocPerm, Frappe's primary access control mechanism. DocPerm assumes that query construction respects user boundaries—that a low-privilege user, even one who can write to a Supplier name field, cannot influence what data gets returned from queries they're not supposed to access. This assumption is now falsified. An attacker with basic authenticated access can write a SQL payload into a Supplier name, then trigger a query that processes that name and executes the payload, potentially extracting admin password hash fragments or modifying data outside their permission scope. For defenders, the priority actions are: First, identify all DocPerm rules that assume data-layer integrity—any rule where a user's own data inputs can influence queries returning other users' data is now suspect. Second, audit user workflows that write to entity name fields and trace whether those fields flow into query construction without re-validation. Third, review your SIEM and detection pipelines: because the attacker already has legitimate authentication, this attack will look like normal supplier-name updates and won't trigger typical anomalous-authentication alerts. Fourth, treat any SQL injection in the data layer as a complete DocPerm bypass until proven otherwise—this CVE demonstrates that the framework's ORM does not provide the security boundary many assumed. The low EPSS (0.00216) likely reflects limited visibility into ERPNext-specific attack campaigns rather than genuine exploitation difficulty. ERPNext deployments typically contain high-value financial data, vendor relationships, and HR records—exactly what targeted attackers prioritize. The absence of observed exploitation so far is not evidence of safety; it's evidence that the vulnerable code path may be invisible to current scanning tools that don't flag ORM string interpolation patterns as injectable. Patch immediately. Beyond patching, reconsider whether DocPerm should be treated as a security boundary at all, or whether it functions more as visibility theater—a distinction that has material implications for your threat model and compliance certifications.

Reviewed through automated stages and approved by a human before publication.