Is CVE-2026-55796 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55796 being exploited in the wild.

How severe is CVE-2026-55796?

Medium severity, with a CVSS score of 6.5, published 16 October 2026.

Which products and versions are affected?

Frappe HR before 15.60.3, before 16.7.1.

Is there a fix for CVE-2026-55796?

Yes: fixed in 15.60.3, 16.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55796 attacked?

It is attacked over the network.

Am I affected by CVE-2026-55796?

Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS report

CVE-2026-55796 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Frappe HR is an open-source human resources management system used to manage employee payroll and benefits. The Salary Payments via ECS report feature contains a SQL injection vulnerability that allows authenticated HR users to access sensitive database records by injecting malicious SQL through report filters. An attacker with HR user credentials could extract confidential employee data, salary information, or other sensitive business records from the database.

Technologies: Frappe HR. Vendors: Frappe.

Quick answers

Is CVE-2026-55796 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55796 being exploited in the wild.
How severe is CVE-2026-55796?: Medium severity, with a CVSS score of 6.5, published 16 October 2026.
Which products and versions are affected?: Frappe HR before 15.60.3, before 16.7.1.
Is there a fix for CVE-2026-55796?: Yes: fixed in 15.60.3, 16.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55796 attacked?: It is attacked over the network.
Am I affected by CVE-2026-55796?: Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 15.60.3, 16.7.1

Technical details

The Salary Payments via ECS report constructs SQL queries using unsafe string interpolation of user-supplied filter values, allowing SQL injection attacks. The vulnerability requires authentication as an HR user and exploitation through crafted report filter inputs. Successful exploitation grants access to sensitive database records beyond the intended report scope.

Affected products

Frappe HR before 15.60.3, before 16.7.1

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.