CVE-2026-55796: Frappe HR SQL Injection Vulnerability

CVE-2026-55796 Overview

CVE-2026-55796 is a SQL injection vulnerability in Frappe HR, an open-source human resources management solution (HRMS). The flaw resides in the Salary Payments via ECS report, which builds SQL conditions through unsafe string interpolation of user-supplied filter values. An authenticated HR user can inject SQL fragments through report filters to read sensitive database records. The issue affects versions prior to 15.60.3 and 16.7.1, and is tracked under [CWE-89].

Critical Impact
Authenticated HR users can exfiltrate sensitive database content by crafting malicious filter values submitted to the Salary Payments via ECS report.

Affected Products

Frappe HR (HRMS) versions prior to 15.60.3
Frappe HR (HRMS) versions prior to 16.7.1
hrms/payroll/report/salary_payments_via_ecs/salary_payments_via_ecs.py report module

Discovery Timeline

2026-10-16 - CVE-2026-55796 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-55796

Vulnerability Analysis

The Salary Payments via ECS report in Frappe HR constructs its WHERE clause by concatenating filter values directly into the SQL query string. Because the filters are not parameterized or escaped, any authenticated HR user with access to the report can supply crafted input that terminates the intended expression and appends attacker-controlled SQL. The injected SQL executes with the database privileges of the Frappe application, enabling retrieval of records outside the HR scope.

Root Cause

The root cause is unsafe string interpolation in the report's condition builder inside salary_payments_via_ecs.py. Filter values received from the client were embedded into raw SQL rather than passed through Frappe's parameterized query builder. This is a classic input validation failure matching [CWE-89] SQL Injection.

Attack Vector

Exploitation requires an authenticated session with permission to run the Salary Payments via ECS report. The attacker submits report filter values containing SQL metacharacters through the standard report UI or API endpoint. Impact is limited to confidentiality: data can be read, but integrity and availability are not directly affected per the CVSS vector (C:H/I:N/A:N).

python

# Patch excerpt from hrms/payroll/report/salary_payments_via_ecs/salary_payments_via_ecs.py
import frappe
from frappe import _
+from frappe.query_builder import DocType
+from frappe.query_builder.functions import Extract

import erpnext

Source: Frappe HRMS commit d823d20

The fix replaces string-interpolated SQL with Frappe's query_builder abstraction, which parameterizes values and prevents injection.

Detection Methods for CVE-2026-55796

Indicators of Compromise

Unexpected SQL metacharacters (single quotes, UNION, --, /*) in report filter parameters submitted to the Salary Payments via ECS endpoint.
Application logs showing SQL syntax errors originating from the salary_payments_via_ecs report path.
HR users querying the report at unusual volume or outside normal business hours.

Detection Strategies

Inspect Frappe HTTP access logs for method=hrms.payroll.report.salary_payments_via_ecs requests containing suspicious filter payloads.
Enable MariaDB/MySQL general query logging in test environments and alert on UNION SELECT, information_schema, or sleep( patterns issued by the Frappe service account.
Correlate failed and malformed SQL events against the authenticated user that triggered the report.

Monitoring Recommendations

Baseline report usage per HR user and alert on anomalous spikes.
Monitor outbound data volume from the Frappe application server to detect bulk exfiltration via report responses.
Track changes to HR role permissions and new accounts granted access to payroll reports.

How to Mitigate CVE-2026-55796

Immediate Actions Required

Upgrade Frappe HR to version 15.60.3 or 16.7.1 as soon as possible.
Review HR and Payroll role assignments and remove access from users who do not require the Salary Payments via ECS report.
Rotate database credentials if logs suggest the vulnerable endpoint was abused prior to patching.

Patch Information

The vendor fixed the issue in Frappe HRMS releases v15.60.3 and v16.7.1. The patches (d823d20 and e9eef45) refactor the report to use frappe.query_builder for safe, parameterized SQL construction. Full details are in GitHub Security Advisory GHSA-c32r-q985-64xr.

Workarounds

Restrict the HR Manager and Payroll roles so only trusted users can execute the Salary Payments via ECS report until the upgrade is applied.
Place a web application firewall rule in front of Frappe to block report filter values containing SQL metacharacters.
Audit the Frappe site for custom reports using the same unsafe string interpolation pattern and refactor them to use frappe.query_builder.

bash

# Upgrade Frappe HR via bench to a fixed release
bench get-app --branch version-16 hrms
bench --site <site-name> install-app hrms
bench update --apps hrms
# Verify the installed version is >= 15.60.3 or >= 16.7.1
bench --site <site-name> list-apps