SQL Injection Vulnerability in Frappe Web Application Framework
CVE-2026-55823

8.7HIGH

Key Information:

Vendor: Frappe
Status: Frappe
Vendor: CVE Published:; 13 October 2026

What is CVE-2026-55823?

An SQL injection vulnerability exists in the Frappe web application framework due to improper handling of SQL query generation in the get_count() method of reportview. This flaw allows an attacker to manipulate crafted report input, leading to unintended SQL commands being executed. The issue has been addressed in version 16.23.0, which reforms the method to ensure safer SQL execution, thereby enhancing the overall security of the framework.