{"id":"CVE-2026-55796","kind":"vulnerability","aliases":["CVE-2026-55796"],"related":[],"title":"Frappe HR: Salary Payments report filters allow SQL injection by HR users","description":"Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.","summary":"The Salary Payments via ECS report in Frappe HRMS builds its SQL query by directly interpolating report filter values into the query string. An authenticated HR user can craft filter values to read sensitive database records.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","hrms","package","self-hosted"],"not_affected_if":["no-hr-users","patched-version"],"how_to_check":"- Check the installed Frappe HRMS version with `bench version` or by inspecting the hrms app's version file; versions before `15.60.3` and `16.7.1` are affected.\n- Confirm the Salary Payments via ECS report is present in the installation.","fix":"- Upgrade Frappe HRMS on the 15.x line to `15.60.3`.\n- Upgrade Frappe HRMS on the 16.x line to `16.7.1`.","status":"open","published_at":"2026-10-16T21:19:18+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:44+00:00","updated_at":"2026-10-25T03:57:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Frappe HRMS on the 15.x line to `15.60.3`.\n- Upgrade Frappe HRMS on the 16.x line to `16.7.1`.","reach":"internet","title":"Frappe HR: Salary Payments report filters allow SQL injection by HR users","impact":"medium","summary":"The Salary Payments via ECS report in Frappe HRMS builds its SQL query by directly interpolating report filter values into the query string. An authenticated HR user can craft filter values to read sensitive database records.","category":"package","nicknames":[],"who_cares":["frappe","hrms","erpnext","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated HR user reads sensitive database records via SQL injection","analyst_note":"","how_to_check":"- Check the installed Frappe HRMS version with `bench version` or by inspecting the hrms app's version file; versions before `15.60.3` and `16.7.1` are affected.\n- Confirm the Salary Payments via ECS report is present in the installation.","needs_analyst":false,"not_affected_if":["patched-version","no-hr-users"],"who_is_affected":"Sites running Frappe HRMS before 15.60.3 or 16.7.1 where users with the HR role can run the Salary Payments via ECS report. Exposure depends on who holds HR access, since the attacker must be authenticated.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3378,"output_tokens":526,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-55796':15A,18A '15.60.3':76C,136C '16.7.1':78C,138C 'access':126C 'affect':107C 'allow':7A,113C 'authent':50B,94C 'build':35B 'condit':87C 'construct':85C 'craft':54B,98C 'cve':13A,16A 'databas':60B,128C 'direct':40B 'ec':30B,83C,102C,111C 'erpnext':19B 'exploit':124C 'filter':6A,43B,55B,104C,121C 'fix':133C 'frapp':1A,20B,33B,62C 'host':25B 'hr':2A,11A,51B,63C,95C 'hrms':21B,34B,73C 'human':69C 'inject':9A,117C 'interpol':41B,92C 'issu':131C 'manag':71C 'open':67C 'open-sourc':66C 'packag':22B 'payment':4A,28B,81C,100C,109C 'prior':74C 'queri':38B,47B 'read':58B 'record':61B,129C 'report':5A,31B,42B,84C,86C,103C,112C,120C 'resourc':70C 'salari':3A,27B,80C,99C,108C 'self':24B 'self-host':23B 'sensit':59B,127C 'solut':72C 'sourc':68C 'sql':8A,37B,90C,118C 'string':48B,91C 'success':123C 'suppli':97C 'unsaf':89C 'user':12A,52B,96C,115C 'valu':44B,56B,105C,122C 'version':135C 'via':29B,82C,101C,110C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe HRMS before 15.60.3 or 16.7.1 where users with the HR role can run the Salary Payments via ECS report. Exposure depends on who holds HR access, since the attacker must be authenticated.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T21:19:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55796","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55796","severity":null,"published_at":"2026-10-16T21:19:18+00:00","modified_at":"2026-10-21T22:16:50+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}