CVE-2026-55823

HIGH 8.7

Published 2026-10-13 · Last modified 2026-10-13

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

ELEVATED IMPACT

Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 29th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

8.7CVSS 4.0 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityLow

What an attacker needs

✓Access: Reachable over the network — no local access needed
⚠Privileges: Requires a low-privilege account
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-55823/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-55823/poc.json

Affected

Vendors Frappe

Products Frappe

Weakness (CWE)

CWE-89: : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

All CVSS metrics

HIGH 8.7 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
HIGH 8.7 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References

Technical & other

https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7 x_refsource_CONFIRM
https://github.com/frappe/frappe/pull/40022 x_refsource_MISC
https://github.com/frappe/frappe/pull/40027 x_refsource_MISC
https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b x_refsource_MISC
https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690 x_refsource_MISC
https://github.com/frappe/frappe/releases/tag/v16.23.0 x_refsource_MISC

Sources: NVD · CVE.org · EPSS