CVE-2026-55823

CVSS 8.7 (high) · published 2026-10-13

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.

Weakness: CWE-89

Source: NVD CVE-2026-55823

References

• https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b
• https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690
• https://github.com/frappe/frappe/pull/40022
• https://github.com/frappe/frappe/pull/40027
• https://github.com/frappe/frappe/releases/tag/v16.23.0
• https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.