# CVE-2026-55823: Frappe SQL injection in reportview get_count method

Source: https://junglewise.ai/threats/cve-2026-55823-frappe-is-a-full-stack-web-application-framework-prior-to-16-23-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-55823 · Severity: info · Published 2026-10-13

Frappe is a web application framework used to build business software. A vulnerability in its report generation feature allows an attacker to modify SQL queries through carefully crafted report parameters, potentially exposing or corrupting database contents. This vulnerability exists in versions before 16.23.0 and has been fixed in that version.

Technologies: [Frappe](https://junglewise.ai/threats/technologies/frappe). Vendors: [Frappe](https://junglewise.ai/threats/vendors/frappe).

## Quick answers

**Is CVE-2026-55823 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55823 being exploited in the wild.

**How severe is CVE-2026-55823?** Informational severity, published 13 October 2026.

**Which products and versions are affected?** Frappe before 16.23.0.

**Is there a fix for CVE-2026-55823?** Yes: fixed in 16.23.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55823 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-55823?** Check whether you run Frappe at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 16.23.0

## Technical details

The get_count() method in frappe/desk/reportview.py composes SQL count operations using raw database execution without proper parameterization, allowing SQL injection via crafted report input. The vulnerability affects the report generation functionality and was remediated by refactoring the code to use the Query Builder abstraction instead of raw SQL. Authentication to the application is likely required to exploit this issue.

## Affected products

- Frappe Frappe before 16.23.0

## Timeline

- 2026-10-13: disclosed

## References

- [https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b](https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b)
- [https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690](https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690)

## Related threats

- [Frappe path traversal in file upload](https://junglewise.ai/threats/cve-2026-119145-frappe-before-15-121-0-and-16-x-before-16-34-0-contains-a-path)
- [Frappe open redirect in OAuth login flow](https://junglewise.ai/threats/cve-2026-66057-frappe-is-a-full-stack-web-application-framework-prior-to-15-116)
- [Frappe missing authorization in record modification](https://junglewise.ai/threats/cve-2026-109599-frappe-before-15-113-3-and-16-x-before-16-25-0-contains-a)
- [Frappe LDAP injection in endpoint parameters](https://junglewise.ai/threats/cve-2025-71431-frappe-before-14-99-2-and-15-x-before-15-86-0-contains-an-ldap)
- [Frappe stored cross-site scripting in leaderboard](https://junglewise.ai/threats/cve-2025-71430-frappe-before-14-99-10-and-15-x-before-15-91-1-contains-a-stored)