Frappe HRMS & ERPNext: Six Auth Bypass and SQLi Flaws Disclosed Together
Key findings • Six vulnerabilities disclosed on October 16, 2026, affecting Frappe HRMS and ERPNext. • Flaws include SQL injection and authorization bypass, with two High severity CVEs. •…
Key findings
- Six vulnerabilities disclosed on October 16, 2026, affecting Frappe HRMS and ERPNext.
- Flaws include SQL injection and authorization bypass, with two High severity CVEs.
- Vulnerabilities range from unauthorized access to employee records to data exfiltration via crafted requests.
- Patches are available for Frappe HRMS and ERPNext across multiple versions.
- Users are urged to update to mitigate risks associated with authenticated exploits.
On October 16, 2026, a batch of six vulnerabilities was disclosed across Frappe's HRMS and ERPNext products, with a disclosure window spanning 18 hours. These vulnerabilities, ranging in severity from Medium to High, primarily stem from authorization flaws and SQL injection, potentially allowing authenticated users to access or manipulate sensitive data.
Two of the disclosed vulnerabilities, CVE-2026-64862 and CVE-2026-108373, are related to authorization issues within Frappe HRMS and ERPNext respectively. CVE-2026-64862, a Medium severity flaw, involves HRMS PWA API endpoints that do not consistently authorize employee-specific requests, allowing authenticated users to access records associated with other employees. Similarly, CVE-2026-108373, also Medium severity, affects the Sales Person-wise Transaction Summary report in ERPNext, where improper authorization checks allow role-limited authenticated users to query financial reports they should not have access to.
A critical vulnerability, CVE-2026-111389, rated High with a CVSSv3 score of 7.7, was found in Frappe HRMS. This SQL injection vulnerability arises from missing input validation in certain endpoints, enabling any authenticated attacker, even with low privileges, to extract sensitive information by sending specially crafted requests. Another SQL injection vulnerability, CVE-2026-55796 (Medium severity), was identified in the Salary Payments via ECS report, where unsafe SQL string interpolation allows authenticated HR users to execute arbitrary SQL commands by supplying crafted report filter values.
Further compounding the security concerns, CVE-2026-108374, a High severity vulnerability, impacts ERPNext. This flaw involves certain endpoints for status modification that fail to enforce proper authorization, allowing low-privileged authenticated users to invoke state-changing methods without the necessary permissions. Lastly, CVE-2026-111388, a Medium severity vulnerability in the Frappe Framework, bypasses IP allowlisting for non-session authentication methods like API keys and OAuth, permitting attackers with valid credentials to authenticate from unauthorized IP addresses.
The disclosed vulnerabilities were addressed in various versions. Frappe HRMS versions prior to 15.58.3 and 16.4.3 are affected by CVE-2026-64862. CVE-2026-55796 impacts versions prior to 15.60.3 and 16.7.1. ERPNext versions prior to 15.121.0 and 16.34.0 are affected by CVE-2026-108374, while CVE-2026-108373 affects versions prior to 15.118.0 and 16.27.0. Frappe HRMS versions prior to 14.38.2, 15.64.0, and 16.18.0 are vulnerable to CVE-2026-111389. Finally, Frappe Framework versions prior to 15.120.0 and 16.33.0 are impacted by CVE-2026-111388. Users of Frappe HRMS and ERPNext are strongly advised to update to the patched versions to mitigate these security risks.
This batch of vulnerabilities highlights the importance of robust authorization checks and input validation in web applications, particularly in sensitive areas like HR and financial reporting. The presence of both SQL injection and authorization bypass flaws across multiple products underscores the need for continuous security auditing and timely patching by Frappe users.
CVE-2026-64862 CVE-2026-55796 CVE-2026-108374 CVE-2026-108373 CVE-2026-111389 CVE-2026-111388