CVE-2026-54524
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
In Frappe HR (an open-source human resources management solution) before version 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. The issue is fixed in 16.7.0.
Risk Assessment
An authenticated user with the HR User role can exploit SQL injection to extract arbitrary data from the database, potentially leading to leakage of confidential information including employee and payroll data.
Recommendation
Update Frappe HR to version 16.7.0 or later. Restrict privileged roles and monitor for unusual queries against payroll reports.
Other vulnerabilities in Frappe HR
See all- CVE-2026-108733Medium
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
- CVE-2026-108732Medium
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
- CVE-2026-101006Medium
A vulnerability was found in Frappe HR up to 16.15.0, affecting the get_expense_claims/get_shift_requests/get_attendance_requests functions in hrms/api/__init__.py (Permission Validation component). Manipulation of the employee argument leads to incorrect authorization. The attack can be launched remotely; the vendor confirmed the issue has already been fixed.
Original NVD description (English source)
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS