Description
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Published: 2026-10-13
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: SQL injection
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the get_count() method of the reportview component in the Frappe framework. Prior to version 16.23.0, this method constructs a raw SQL COUNT query based on report input without proper validation or escaping. By supplying crafted report data, an attacker can inject arbitrary SQL into the executed statement, potentially reading, modifying, or deleting data in the underlying database. This does not provide direct code execution, but it does allow unauthorized data access and integrity compromise.

Affected Systems

Affected vendors and products are listed under "frappe:frappe". The issue applies to all releases before 16.23.0 of the framework. Versions 16.23.0 and later include the fix.

Risk and Exploitability

The CVSS score of 8.7 indicates high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector involves sending specially crafted report input via the web interface or API. The exploit requires legitimate access to the reporting interface, suggesting that it is an authenticated attack, though the exact privilege level is not specified in the advisory.

Generated by OpenCVE AI on October 13, 2026 at 19:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to version 16.23.0 or newer where the raw SQL execution path is removed.
  • If an immediate upgrade is not possible, limit user permissions so that only trusted accounts can create or run reports, thereby reducing the opportunity for injection.
  • Continuously monitor application logs for anomalous SQL queries or report submissions that deviate from expected patterns.

Generated by OpenCVE AI on October 13, 2026 at 19:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Frappe
Frappe frappe
Vendors & Products Frappe
Frappe frappe

Tue, 13 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Description Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
Title Frappe: Possibility of SQL injection in reportview
Weaknesses CWE-89
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-13T17:51:54.927Z

Reserved: 2026-06-17T16:29:38.864Z

Link: CVE-2026-55823

cve-icon Vulnrichment

Updated: 2026-10-13T17:51:51.684Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:42.390

Modified: 2026-10-13T18:17:24.473

Link: CVE-2026-55823

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T19:30:12Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')