{"id":"CVE-2026-55823","title":"Frappe is a full-stack web application framework","summary":"Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL ex…","severity":"none","cwe":["CWE-89"],"published":"2026-10-13","updated":"2026-10-13","sourceUpdated":"2026-10-13T18:17:24.473","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55823","references":[{"url":"https://github.com/frappe/frappe/commit/49dbde7460fa41528154088d23b6c6e12f733f9b","label":"security-advisories@github.com"},{"url":"https://github.com/frappe/frappe/commit/f4f2df926e3c2db2da5fc79983f285397c028690","label":"security-advisories@github.com"},{"url":"https://github.com/frappe/frappe/pull/40022","label":"security-advisories@github.com"},{"url":"https://github.com/frappe/frappe/pull/40027","label":"security-advisories@github.com"},{"url":"https://github.com/frappe/frappe/releases/tag/v16.23.0","label":"security-advisories@github.com"},{"url":"https://github.com/frappe/frappe/security/advisories/GHSA-mf6r-q34j-pjw7","label":"security-advisories@github.com"}],"tags":["nvd"],"ingestedAt":"2026-10-13T17:38:53.196Z","slug":"CVE-2026-55823","body":"## Overview\n\nFrappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application. This issue is fixed in version 16.23.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}