{"id":"CVE-2026-114664","kind":"vulnerability","aliases":["CVE-2026-114664"],"related":[],"title":"Frappe Framework: blind SQL injection in event listing lets logged-in users read database","description":"Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.","summary":"Frappe Framework versions before 16.33.0 let an authenticated user send crafted input to the get_events method, which places it unescaped into a SQL query. The attacker can infer database contents from application behavior and extract sensitive data.","severity":"high","cvss":7.1,"epss":0.00199,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","python","runtime","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed Frappe version with `bench version` or `frappe.__version__` and compare it to `16.33.0`\n- Confirm whether the Desk calendar event endpoint is reachable by logged-in users on your site","fix":"- Upgrade Frappe Framework to `16.33.0` or later\n- Rebuild and restart the bench after upgrading","status":"open","published_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:31:44+00:00","updated_at":"2026-10-25T03:31:44+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:31:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Frappe Framework to `16.33.0` or later\n- Rebuild and restart the bench after upgrading","reach":"internet","title":"Frappe Framework: blind SQL injection in event listing lets logged-in users read database","impact":"high","summary":"Frappe Framework versions before 16.33.0 let an authenticated user send crafted input to the get_events method, which places it unescaped into a SQL query. The attacker can infer database contents from application behavior and extract sensitive data.","category":"runtime","nicknames":[],"who_cares":["frappe","erpnext","self-hosted","python"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user reads sensitive database contents via blind injection","analyst_note":"Check the Frappe 16.33.0 release notes or the NVD entry for the affected role or permission requirements and whether the flaw is reachable by any logged-in user.","how_to_check":"- Check the installed Frappe version with `bench version` or `frappe.__version__` and compare it to `16.33.0`\n- Confirm whether the Desk calendar event endpoint is reachable by logged-in users on your site","needs_analyst":true,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Sites running Frappe Framework before 16.33.0, including ERPNext and other Frappe apps built on it, where users can log in to the Desk. Exposure requires an account, so sites with no user login (or only public static pages) are not exposed through this path. unknown whether the sources name specific roles or settings that narrow exposure further.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000629,"input_tokens":3368,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114664':18A,21A '-2026':17A,20A '16.33.0':33B,70C 'applic':61B,111C 'attack':55B,98C 'authent':36B,97C 'behavior':62B,112C 'blind':3A,73C 'contain':71C 'content':59B 'craft':39B,101C 'cve':16A,19A 'data':66B 'databas':15A,58B,116C 'erpnext':22B 'event':7A,44B,80C,105C 'extract':64B,114C 'fail':83C 'framework':2A,30B,68C 'frapp':1A,23B,29B,67C 'frappe.desk.doctype.event.event.get':79C 'get':43B,104C 'host':28B 'includ':92C 'infer':57B,107C 'inform':117C 'inject':5A,75C 'input':40B,90C,102C 'let':9A,34B 'list':8A 'log':11A 'logged-in':10A 'method':45B,81C 'neutral':86C 'place':47B 'proper':85C 'python':24B 'queri':53B,96C,108C 'read':14A 'result':109C 'runtim':25B 'self':27B 'self-host':26B 'send':38B,100C 'sensit':65B,115C 'sql':4A,52B,74C,95C 'suppli':89C 'unescap':49B 'user':13A,37B,88C 'user-suppli':87C 'version':31B 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe Framework before 16.33.0, including ERPNext and other Frappe apps built on it, where users can log in to the Desk. Exposure requires an account, so sites with no user login (or only public static pages) are not exposed through this path. unknown whether the sources name specific roles or settings that narrow exposure further.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114664","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114664","severity":null,"published_at":"2026-10-22T02:16:58+00:00","modified_at":"2026-10-22T02:16:58+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114664","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114664","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}