---
id: "CVE-2026-55796"
kind: "vulnerability"
aliases: ["CVE-2026-55796"]
title: "Frappe HR: Salary Payments report filters allow SQL injection by HR users"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe", "hrms", "package", "self-hosted"]
not_affected_if: ["no-hr-users", "patched-version"]
published_at: "2026-10-16T21:19:18+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55796", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Frappe HR: Salary Payments report filters allow SQL injection by HR users

The Salary Payments via ECS report in Frappe HRMS builds its SQL query by directly interpolating report filter values into the query string. An authenticated HR user can craft filter values to read sensitive database records.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Frappe HRMS version with `bench version` or by inspecting the hrms app's version file; versions before `15.60.3` and `16.7.1` are affected.
- Confirm the Salary Payments via ECS report is present in the installation.

## Fix

- Upgrade Frappe HRMS on the 15.x line to `15.60.3`.
- Upgrade Frappe HRMS on the 16.x line to `16.7.1`.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55796

## From the sources

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_