# CVE-2026-55796: Frappe HR SQL injection in Salary Payments via ECS report

Source: https://junglewise.ai/threats/cve-2026-55796-frappe-hr-is-an-open-source-human-resources-management-solution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55796 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Frappe HR is an open-source human resources management system used to manage employee payroll and benefits. The Salary Payments via ECS report feature contains a SQL injection vulnerability that allows authenticated HR users to access sensitive database records by injecting malicious SQL through report filters. An attacker with HR user credentials could extract confidential employee data, salary information, or other sensitive business records from the database.

Technologies: [Frappe HR](https://junglewise.ai/threats/technologies/hr). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2026-55796 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55796 being exploited in the wild.

**How severe is CVE-2026-55796?** Medium severity, with a CVSS score of 6.5, published 16 October 2026.

**Which products and versions are affected?** Frappe HR before 15.60.3, before 16.7.1.

**Is there a fix for CVE-2026-55796?** Yes: fixed in 15.60.3, 16.7.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55796 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55796?** Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 15.60.3, 16.7.1

## Technical details

The Salary Payments via ECS report constructs SQL queries using unsafe string interpolation of user-supplied filter values, allowing SQL injection attacks. The vulnerability requires authentication as an HR user and exploitation through crafted report filter inputs. Successful exploitation grants access to sensitive database records beyond the intended report scope.

## Affected products

- Frappe HR before 15.60.3, before 16.7.1

## Timeline

- 2026-10-16: disclosed

## References

- [https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6](https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6)
- [https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66](https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66)

## Related threats

- [Frappe HR authorization bypass in PWA API endpoints](https://junglewise.ai/threats/cve-2026-64862-frappe-hr-is-an-open-source-human-resources-management-solution)
- [Frappe HR missing authorization in expire_allocation](https://junglewise.ai/threats/cve-2026-108733-frappe-hr-hrms-before-16-11-0-including-all-14-x-and-15-x)
- [Frappe HR authorization bypass in API functions](https://junglewise.ai/threats/cve-2026-101006-a-flaw-has-been-found-in-frappe-hr-up-to-16-15-0-this)
- [Frappe HR SQL injection in Salary Payments report filters](https://junglewise.ai/threats/cve-2026-54524-frappe-hr-sql-injection-in-salary-payments-report-filters)
- [Frappe HR incorrect authorization in Leave Details API](https://junglewise.ai/threats/cve-2026-45081-frappe-hr-incorrect-authorization-in-leave-details-api)