Frappe HRMS CVE-2026-111389

Exploitation requires an authenticated session on Frappe HRMS - the CVSS vector specifies PR:L, so any valid low-privilege account (e.g. a standard employee login) suffices; anonymous unauthenticated access is NOT sufficient. The attacker must reach the specific endpoints that lack input validation and send specially crafted requests carrying SQL injection payloads. Affected deployments are those running Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, or 16.x before 16.18.0; patched versions remove the exposure. No special non-default configuration or user interaction (UI:N) is needed beyond holding valid credentials, but the authentication requirement is the primary factor limiting mass, unauthenticated exploitation.

This is a credible, above-average-priority issue but not an emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only a low-privilege authenticated account, with high confidentiality impact to both the vulnerable system (VC:H) and a subsequent system (SC:H) and no integrity or availability impact - consistent with a read-oriented SQL injection used for data exfiltration (CWE-89). The score of 8.3 is driven by broad confidentiality exposure rather than system takeover. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization at this time; exploitation status is best characterized as no public exploit identified at time of analysis. The main tempering factor versus the high CVSS is the PR:L authentication requirement: an attacker needs a valid (even if minimal) account, which limits purely anonymous internet-wide scanning but is realistic in multi-tenant HR deployments where many employees hold low-privilege logins. Net: a real, patch-worthy priority for any exposed Frappe HRMS instance, but the absence of KEV/EPSS/POC signals suggests it is not yet under widespread exploitation.

A low-privilege employee or any attacker who has obtained valid HRMS credentials sends specially crafted requests to the affected unvalidated endpoints, injecting SQL that the application executes against the backend database. Because the vector is network-based with low attack complexity, the attacker can iteratively extract sensitive HR data - salaries, personal records, credentials - belonging to other users. No public exploit code was identified, so exploitation currently requires the attacker to craft the injection manually.