CVE-2026-55823

EUVD-2026-98928
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
GitHub_MCNA
8.7 HIGH
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 28.7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
frappefrappe
𝑥
< 16.23.0
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
https://github.com/frappe/frappe/pull/40022
https://github.com/frappe/frappe/pull/40027
https://github.com/frappe/frappe/releases/tag/v16.23.0
https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7