CVE-2026-54524

Overview

Frappe HR before version 16.7.0 contains an SQL injection vulnerability in the Salary Payments Based on Payment Mode report. An authenticated attacker with the HR User role can exploit this flaw by manipulating filter parameters. This vulnerability matters because it allows unauthorized extraction of arbitrary database data.

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Impact

This vulnerability impacts the confidentiality and integrity of the database managed by the affected HRMS deployment, as authenticated users can read arbitrary data. While availability remains largely unaffected, the exposure of sensitive human resources and payroll data presents significant compliance and privacy risks. The impact is restricted to users who already possess the HR User role within the application.

Remediation

Upgrade Frappe HR to version 16.7.0 or later where the vulnerable report logic in get_conditions and get_data is fixed. Ensure proper input sanitization and parameterized queries are utilized if custom reporting logic is developed. Review role-based access controls to limit the assignment of the HR User role to trusted personnel.

Risk context

This vulnerability is rated as high severity with a CVSS v3 score of 8.1 and a CVSS v4 score of 7.1. Although EPSS data is not available, the requirement for authentication reduces immediate exposure, but high privilege misuse remains a concern.

Affected products

• Frappe HRMS < 16.7.0