CVE-2026-55796

Executive Summary

CVE-2026-55796 is an authenticated SQL injection (CWE-89) vulnerability in the open-source Frappe HR human resources management system. The flaw resides in the "Salary Payments via ECS" report, which builds its SQL query conditions using unsafe string interpolation of user-supplied report filter values. Any authenticated HR user can inject arbitrary SQL through those filters, enabling read access to sensitive database records; the issue is resolved in versions 15.60.3 and 16.7.1.

Technical Analysis

Frappe HR is an open-source HRMS built on the Frappe framework. The affected component is a report named "Salary Payments via ECS," which assembles database query conditions by directly interpolating report filter values into SQL strings rather than using parameterized queries or the framework's safe query abstraction. This is a textbook SQL injection pattern under CWE-89.

The attack surface is the report filter interface. When an HR user generates the report and supplies filter values, those values are concatenated into the query condition string. Because the construction is not parameterized, an attacker who controls a filter value can terminate or alter the intended SQL condition and append their own SQL logic (e.g., UNION-based or boolean/error-based subqueries) to read data the query was never intended to return.

Key characteristics:

• Privilege requirement: The attacker must be an authenticated HR user (PR:L). The vulnerability is not pre-authentication.
• Network-reachable: Exploitation occurs over the normal HRMS web interface (AV:N).
• Confidentiality-only impact: Successful exploitation is described as allowing access to sensitive database records; the NVD description does not state integrity or availability impact, which is consistent with the CVSS vector (C:H, I:N, A:N).
• No user interaction: The attacker generates the report themselves (UI:N).

The NVD description does not disclose the specific parameter name, code path, or sink. No public PoC, Nuclei template, or exploit code is known, so the precise payload syntax cannot be verified and any concrete function names would be speculative. The vulnerability class — interpolation-based SQL injection in a report filter — is fully established by the description.

The severity is moderate (6.5). The high confidentiality subscore applies because the underlying database holds HR/payroll records, but exploitation requires an authenticated HR account, which constrains the threat to insider abuse or to attackers who have already obtained valid credentials via other means.

Exploitation Scenarios

No public PoC is available; the chain below is inferred from the vulnerability class (authenticated SQL injection via report filters).

1. Reconnaissance / target identification. The attacker locates an internet-facing (or internal) Frappe HR instance. Access typically requires an authenticated account; the report is an HR-only feature, so the attacker either holds legitimate HR credentials, has compromised an HR account, or has acquired one through phishing or credential reuse.

2. Triggering the flaw class. Once authenticated, the attacker navigates to the "Salary Payments via ECS" report, sets the filter parameters, and supplies a crafted value. Because the report concatenates this value into the SQL condition string, the attacker's input becomes part of the executed query rather than being treated as data.

3. Execution at the vulnerability-class level. Using standard SQL injection techniques — UNION-based extraction, boolean/proportional inference, or error-based probing — the attacker extends the query to retrieve additional tables or columns beyond the report's intended result. Success depends on the receiving user's database permissions, which are typically sufficient to read HR records.

4. Post-exploitation impact. Exfiltration of sensitive database records: employee data, salary and payment information, and other HR data accessible to the database account. The NVD description indicates a confidentiality impact only; no write or denial-of-service effect is stated.

Impact Assessment

• Business impact: Disclosure of HR and payroll data — employee personal information, salary details, and payment records. These data sets carry significant regulatory and privacy exposure (e.g., GDPR/CCPA obligations) and may facilitate downstream social engineering or fraud.
• Blast radius: Any records the application's database user can read. Because HRMS databases aggregate cross-tenant/cross-employee data, a single successful query can expose a large volume of records.
• CVSS interpretation: 6.5 Medium — AV:N (network), AC:L (no special conditions), PR:L (authenticated HR user), UI:N (attacker-driven), S:U (scope unchanged), C:H (high confidentiality), I:N (no integrity), A:N (no availability). The overall impact is bounded by the authentication prerequisite; an attacker already inside the HR trust boundary gains a high- confidentiality read primitive.
• Threat posture: No CISA KEV listing, no EPSS score, no known exploit code. Realistic risk comes from malicious insiders or from external actors who have obtained valid HR credentials.

Detection Guidance

Sigma Rule

Detects SQL-injection-shaped payloads in web access logs targeting the report endpoint.

title: Frappe HR Salary Payments via ECS SQL Injection Attempt
id: 3b9f2c1a-7e4d-4a2b-9c1e-557960000001
status: experimental
description: Detects SQL injection patterns in requests to the Frappe HR Salary Payments via ECS report endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-55796
author: valtersit threat intelligence
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-query|contains:
      - 'Salary Payments via ECS'
      - 'salary_payments_via_ecs'
  selection_sqli:
    cs-uri-query|contains:
      - 'UNION SELECT'
      - 'union+select'
      - "' OR "
      - "' AND "
      - 'SLEEP('
      - 'BENCHMARK('
      - 'information_schema'
      - '--'
      - '/*'
  condition: selection_path and selection_sqli
falsepositives:
  - Legitimate report queries containing SQL keywords in filter text
level: high

YARA Rule

rule CVE_2026_55796_FrappeHR_EC_SQLi
{
    meta:
        description = "Detects SQL-injection filter markers associated with CVE-2026-55796 in Frappe HR Salary Payments via ECS report requests"
        cve = "CVE-2026-55796"
        author = "valtersit threat intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-55796"
        date = "2026-01-01"
    strings:
        $report1 = "Salary Payments via ECS" nocase
        $report2 = "salary_payments_via_ecs" nocase
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "union+select" nocase
        $sqli3 = "information_schema" nocase
        $sqli4 = "SLEEP(" nocase
        $sqli5 = "BENCHMARK(" nocase
        $sqli6 = "' OR " nocase
        $sqli7 = "' AND " nocase
    condition:
        ($report1 or $report2) and 1 of ($sqli*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-55796 Frappe HR Salary Payments via ECS SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"Salary Payments via ECS"; nocase; http.uri; pcre:"/UNION\s+SELECT|information_schema|SLEEP\(|BENCHMARK\(/i"; reference:cve,CVE-2026-55796; classtype:web-application-attack; sid:5579601; rev:1;)

Elastic Detection

network where
  url.full : "*Salary*Payments*via*ECS*" and
  (
    url.query : "*UNION*SELECT*" or
    url.query : "*union*select*" or
    url.query : "*information_schema*" or
    url.query : "*SLEEP(*" or
    url.query : "*BENCHMARK(*" or
    url.query : "*' OR *" or
    url.query : "*' AND *"
  )

Splunk SPL Query

index=web sourcetype=*access*
| eval uri_raw = lower(coalesce(uri, url, cs_uri_query))
| where (match(uri_raw, "salary.?payments.?via.?ecs"))
  AND (match(uri_raw, "(union(\+|%20| )select)")
    OR match(uri_raw, "information_schema")
    OR match(uri_raw, "sleep\(")
    OR match(uri_raw, "benchmark\(")
    OR match(uri_raw, "'( )?(or|and)( )?"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_raw
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-55796,">
  <rule id="557960" level="12">
    <if_sid>31100</if_sid>
    <url>Salary Payments via ECS|salary_payments_via_ecs</url>
    <regex type="pcre2">(?i)(union(\+|%20|\s)select|information_schema|sleep\(|benchmark\(|'\s*(or|and)\s)</regex>
    <description>CVE-2026-55796: SQL injection attempt against Frappe HR Salary Payments via ECS report</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>sql_injection,web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Restrict access to the "Salary Payments via ECS" report and HRMS backend to trusted networks/VPN; do not expose HR to the public internet without authentication and network controls.
   • Enforce strong authentication and least-privilege HR roles; audit the roster of HR-authorized users and remove dormant or excess accounts.
   • Run the underlying database user with the minimum privileges required for HRMS operations (no broad read/write on unrelated schemas).
   • Deploy the web-layer detection rules above (Suricata/WAF pattern matching) to block filter values containing SQL metacharacters on report endpoints.

2. Patch / upgrade steps

   • Upgrade Frappe HR to 15.60.3 or 16.7.1 (or later). The NVD description states these versions contain the fix.
   • Because no patch diff is available from tracked sources, verify the fix by confirming the new version replaces string interpolation with parameterized query construction in the report logic, and regression-test the report's filter functionality.
   • After upgrade, retroactively review database logs for anomalous report queries and audit HR data access.

3. Long-term hardening

   • Mandate parameterized queries/framework query builders for all custom report logic; prohibit string-concatenated SQL in code review and CI checks (static analysis for CWE-89).
   • Apply least-privilege DB roles to the application and segment the HRMS database.
   • Continuously inventory Frappe HR versions and subscribe to vendor security advisories; monitor NVD for this CVE.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-55796
• CWE-89 (SQL Injection): https://cwe.mitre.org/data/definitions/89.html
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Frappe HR project repository/releases: https://github.com/frappe/hrms
• No CISA KEV listing and no known exploit-in-the-wild evidence or attributed threat actor campaigns at time of writing.