CVE-2026-41320
Received Received - Intake

SQL Injection in Frappe HR Allows Unauthorized Data Access

Publication date: 2026-04-21

Last updated on: 2026-04-27

Assigner: GitHub, Inc.

Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-21
Last Modified
2026-04-27
Generated
2026-07-26
AI Q&A
2026-04-21
EPSS Evaluated
2026-07-25
NVD
CVE-2026-41320
EUVD
EUVD-2026-24290

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe frappe_hr to 14.38.1 (exc)
frappe frappe_hr From 15.0.0 (inc) to 15.54.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-41320 is a moderate severity SQL injection vulnerability affecting the Frappe HRMS software in versions prior to 15.54.0 and 14.38.1.

The vulnerability occurs because the software improperly sanitizes user-supplied input fields, constructing SQL commands using external input without adequately neutralizing special SQL elements.

This flaw allows an attacker to send specially crafted requests to a specific endpoint, injecting malicious SQL code that can extract sensitive information that they would not normally have access to.

Detection Guidance

This vulnerability can be detected by monitoring for specially crafted requests made to the vulnerable endpoint that attempt SQL injection. Since the issue arises from improper sanitization of user-supplied input fields, detection involves identifying unusual or malicious SQL syntax in requests targeting the affected hrms package.

Specific commands are not provided in the available resources. However, typical detection methods might include using web application firewalls (WAF) with SQL injection detection rules, or analyzing logs for suspicious payloads containing SQL keywords or special characters in requests to the hrms endpoints.

Impact Analysis

This vulnerability impacts the confidentiality of your data by allowing attackers to extract sensitive information unauthorizedly.

The attack requires network access and low privileges, does not require user interaction, and does not affect the integrity or availability of the system.

Therefore, an attacker could potentially access confidential data stored in the HRMS without permission, which could lead to data breaches or exposure of personal or sensitive information.

Compliance Impact

This SQL injection vulnerability allows attackers to extract sensitive information without authorization, impacting the confidentiality of data handled by the Frappe HRMS system.

Since the vulnerability compromises data confidentiality, it could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which mandate the protection of sensitive personal and health information.

Organizations using affected versions of Frappe HRMS should upgrade to the patched versions to mitigate the risk and maintain compliance with these standards.

Mitigation Strategies

The immediate and recommended mitigation step is to upgrade the Frappe HRMS software to the patched versions 15.54.0 or 14.38.1, which contain fixes for this SQL injection vulnerability.

No known workarounds are available, so applying the official patch is essential to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-41320. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart