CVE Alert: CVE-2026-114664 – frappe

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL queries. Authenticated attackers can send crafted input to get_events and infer query results from application behavior to extract sensitive database information.

**Risk verdict:** High risk for internet-reachable deployments; no active-exploitation urgency can be confirmed because KEV and SSVC status were not supplied.

**Why this matters:** A low-privilege account could potentially extract sensitive records through repeated queries, creating privacy, regulatory and commercial exposure. Limited data modification is also plausible, but the supplied impact assessment does not indicate direct service disruption or wider system impact. EPSS and PoC data are absent, so exploitation likelihood and attacker readiness remain uncertain.

**Most likely attack path:** An attacker first obtains or uses a valid low-privilege account, then sends crafted requests to the event functionality over the network. No user interaction or special conditions are indicated, making exploitation relatively straightforward once authenticated; the assessed scope is unchanged, so direct lateral movement is not indicated.

**Who is most exposed:** Prioritise internet-facing business applications built on this framework, especially those with broad user access or sensitive event and customer data.

Review requests to the event endpoint for unusual parameters, repeated probing or encoded SQL syntax.

Correlate suspicious request bursts with database query logs and abnormal read volume.

Look for response timing or content differences consistent with repeated inference attempts.

Check authentication logs for compromised or misused low-privilege accounts.

Mitigation and prioritisation:

Upgrade promptly to the vendor-fixed release; verify deployment coverage across all instances.

Restrict access to the affected functionality and exposed application surfaces where feasible.

Apply least privilege to application accounts and database access; monitor for unusual reads.

Test the update in staging and coordinate rollout with application owners.

Obtain KEV, SSVC, EPSS and PoC status before finalising urgency; reassess if any indicate active or likely exploitation.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.