Frappe Framework: SQL injection in reportview get_count()
Summary
The get_count() method in the reportview component of Frappe, a full-stack web framework used for applications such as ERPNext, builds a count query from generated SQL and executes it through a raw database path. Crafted report input can alter the SQL run by the application. An authenticated user with low privileges can read and potentially modify database content such as customer, invoice or HR data; availability impact is rated low.
Affected
- Frappe versions prior to 16.23.0
- Downstream applications built on affected Frappe versions, such as ERPNext (to be confirmed per application)
- Status of the 15.x branch: Unknown.
Fixed in
- Frappe 16.23.0 (commit 49dbde7460fa41528154088d23b6c6e12f733f9b and f4f2df926e3c2db2da5fc79983f285397c028690)
- Fixed 15.x release: Unknown.
Workaround
- No vendor-documented workaround known. Upgrading is the recommended fix.
Exploitation
- No public proof of concept confirmed at the time of writing.
- Not listed in the CISA KEV catalog.
- EPSS is very low (0.00365).
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- Identify all Frappe and ERPNext instances and their versions (bench version).
- Upgrade to Frappe 16.23.0 or later; confirm the 15.x upgrade path in the GitHub security advisory before upgrading.
- Review user accounts and remove unused logins, since low-privilege access is the prerequisite.
- Check whether instances are reachable from the internet and restrict access where possible.
- Monitor the GitHub advisory GHSA-mf6r-q34j-pjw7 and the CISA KEV catalog for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-mf6r-q34j-pjw7 github.com
- Frappe release v16.23.0 github.com
- Fix commit 49dbde7 github.com
- Fix commit f4f2df9 github.com
- OSV CVE-2026-55823 osv.dev
- Vulners RAPID7 CVE-2026-55823 (EPSS) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 04:24.
Original description (NVD)
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.
NVD references (6)
- https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
- https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
- https://github.com/frappe/frappe/pull/40022
- https://github.com/frappe/frappe/pull/40027
- https://github.com/frappe/frappe/releases/tag/v16.23.0
- https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.