Frappe Framework EUVD-2026-98928

Requires an authenticated session (CVSS PR:L) with access to Frappe's report/list view API, and the ability to supply crafted report input (fields/filters) that reaches the get_count() method in frappe/desk/reportview.py; in affected versions (<16.23.0) that input was composed into a raw 'select count(*) from ( ... )' statement via frappe.db.sql() f-string interpolation, allowing SQL to be altered. Limiting factors: exploitation is not anonymous - a valid Frappe/ERPNext account with report access is needed - which restricts the attacker population to registered or compromised users; no special non-default configuration is indicated, so default deployments running a version prior to 16.23.0 are exposed to authenticated users.

This is a genuine, actionable SQL injection (CWE-89) in Frappe's reportview get_count() path, not merely a high-number-but-low-risk issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and score of 8.7 indicate a network-reachable, low-complexity flaw with high confidentiality and integrity impact (VC:H/VI:H) and limited availability impact (VA:L), requiring only low privileges (PR:L) - i.e., an authenticated but not necessarily highly-privileged user. The PR:L requirement is the main dampener: exploitation needs a valid session with access to the report/list view API, so this is not fully anonymous mass-exploitable, which argues for targeted rather than internet-wide abuse. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so automatable/exploitation signals cannot be cross-referenced; absence of KEV/EPSS here is a data gap, not evidence of low risk. Public fix commits and a detailed patch diff exist (PRs 40022/40027), which materially lowers the effort to reverse-engineer a working exploit even though no standalone exploit code was supplied. Net: treat as a real patching priority for any internet-facing or multi-tenant Frappe/ERPNext deployment, while noting the authenticated-access precondition narrows the realistic threat population.

An authenticated low-privilege user (or an attacker who has phished/obtained any valid Frappe account) submits a crafted report query to the list/report view endpoint whose count operation flows into get_count(), where report input is composed into raw SQL via a raw database execution path. The injected SQL alters the executed query, letting the attacker read or tamper with database data beyond their authorization. No public standalone exploit was provided, but the upstream fix commits and patch diff are public, making the vulnerable code path easy to identify and weaponize.