Frappe HR CVE-2026-55796

Requires an authenticated user with HR/Payroll privileges sufficient to access the 'Salary Payments via ECS' report; the attacker injects SQL through the report's filter values (department, branch, company, month, or year), which were concatenated directly into the query string. Exploitation is limited to Frappe HR versions prior to 15.60.3 (15.x line) and 16.7.1 (16.x line). The principal limiting factor is the authentication and authorization requirement - a valid HR-level account is needed - so this is an insider or post-credential-compromise vector rather than an anonymous remote attack; no special non-default configuration is required for the vulnerable report itself.

This is a moderate, authentication-gated SQL injection (CWE-89) with a self-consistent CVSS 3.1 vector (6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The signals align and present no contradictions: network-reachable but requiring valid credentials (PR:L), low complexity, and confidentiality-only impact (C:H, I/A:N), consistent with a read-oriented report query that exposes employee, gross_pay, and net_pay data. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is no evidence of active or at-scale exploitation. The practical risk is therefore bounded by the requirement for an authenticated HR user - the attacker is already a semi-trusted insider or someone who has compromised HR credentials. This is a legitimate 'patch in normal cycle' issue rather than an emergency: the SQL injection is real and confirmed by the vendor fix commit (migration from string interpolation to the parameterized frappe.qb query builder), but the privilege prerequisite and absence of exploitation signals keep it well below the urgency of an unauthenticated RCE. Missing data to note: EPSS probability is absent (cannot quantify likelihood) and KEV status is not confirmed, so prioritization relies on CVSS and code evidence alone.

An authenticated user with access to the HR/Payroll module opens the 'Salary Payments via ECS' report and enters a crafted value into a filter field (department, branch, company, month, or year). Because the report built its WHERE clause via unsafe Python string interpolation, the injected SQL executes against the database, letting the attacker read sensitive salary and employee records beyond their intended scope. No public exploit code was identified at the time of analysis, but the vulnerable pattern is clearly visible in the vendor's fix commit.