CVE-2026-55823: Frappe: Possibility of SQL injection in reportview

Severity: high (CVSS 8.7 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-13
Weakness: CWE-89

Description

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

Affected products

frappe: before 16.23.0

References

https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
https://github.com/frappe/frappe/pull/40022
https://github.com/frappe/frappe/pull/40027
https://github.com/frappe/frappe/releases/tag/v16.23.0
https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7

Get alerted when CVE-2026-55823 or the next vulnerability affects your stack