CVE-2026-55823
HIGH
8,7
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Authentication
Access Control
Potential Impacts:
Execute Unauthorized Code Or Commands
Read Application Data
Gain Privileges Or Assume Identity
Bypass Protection Mechanism
Modify Application Data
Applicable Platforms
Languages:
Not Language-Specific, SQL
Technologies:
Database Server
https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
https://github.com/frappe/frappe/pull/40022
https://github.com/frappe/frappe/pull/40027
https://github.com/frappe/frappe/releases/tag/v16.23.0
https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7