Frappe HRMS CVE-2026-41320

Exploitation requires a valid authenticated session in Frappe HRMS (PR:L per CVSS vector), meaning the attacker must hold at least a low-privileged user account - such as a standard employee login. Network-level access to the HRMS application is required (AV:N), but no elevated role or administrative privileges are indicated. No specific non-default configuration is required beyond a standard Frappe HRMS deployment running an affected version. Exploitation is not automatable per SSVC, suggesting the specific vulnerable endpoint and parameter require discovery or knowledge not trivially scripted. What limits exploitation: the attacker must already possess valid credentials; CVSS I:N and A:N confirm that write or destructive operations are not achievable through this vector - impact is read-only data extraction.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 (Medium), reflecting low-complexity network exploitation but requiring prior authentication (PR:L). The confidentiality impact is High, consistent with SQL injection enabling unrestricted read access to HR database contents including employee PII, payroll, and organizational data. However, multiple signals temper urgency: EPSS at 0.03% places this in the bottom 10th percentile for exploitation probability; SSVC classifies exploitation as 'none' and technical impact as 'partial'; no KEV listing exists; and SSVC marks it as not automatable, suggesting exploitation is not trivially scriptable at scale. The absence of workarounds (stated explicitly by the vendor) means the only remediation path is patching, which slightly elevates practical risk for organizations slow to upgrade. Overall this is a genuine medium-priority issue warranting scheduled patching - not emergency response - for organizations using Frappe HRMS with internet-exposed deployments.

An attacker with a valid low-privileged HRMS user account - such as a regular employee - crafts a malicious HTTP request to the vulnerable endpoint, injecting SQL syntax into an expected parameter. The injected query enumerates and exfiltrates HR database tables containing employee records, salary information, or organizational structures, bypassing application-level access controls without triggering authentication failures.