CVE-2026-65822

In ERPNext versions before 15.116.0 and 16.23.0, the Inactive Customers report (inactive_customers.py) passes an unvalidated doctype filter directly into raw SQL via get_sales_details and get_last_sales_amt, enabling authenticated users to extract sensitive data and manipulate queries. CISA repor...