Advisory · CVE-2026-111389
Any signed-in Frappe HRMS user can pull database data through SQL injection
Frappe HRMS before 14.38.2, 15.64.0, and 16.18.0 leaves some endpoints open to SQL injection, letting any authenticated account, however low-privilege, extract sensitive database information. CVSS 4.0 8.3.
- Vendor
- Frappe
- Product
- Frappe HRMS
- Identifier / CWE
- CVE-2026-111389
CWE-89 - Action timing
- Immediate
Explain it like I’m five
The HR system lets any employee account ask the database questions it was never supposed to ask, because some screens forgot to check the question before passing it along.
- 01Low-privilege sign-in
An attacker signs in with any authenticated account, including a low-privilege one.
- 02Crafted request sent
The attacker sends specially crafted requests to endpoints that miss input validation.
- 03Input reaches SQL
The crafted input is incorporated into database queries without adequate neutralisation.
- 04Database data extracted
The attacker extracts sensitive information from the HRMS database through the injected queries.
What happened
The Frappe security advisory for HRMS states that some endpoints were vulnerable to SQL injection through specially crafted requests, caused by missing input validation. Affected release lines are 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0.
Any authenticated user, including a low-privilege account, could exploit the flaw to extract sensitive information from the database. Frappe states there is no workaround and upgrading is required.
HRMS holds employee records, payroll-adjacent data, and organisational structure, so a read primitive available to every account in the system reaches well beyond the attacker’s own role.
What to do
- Inventory Frappe HRMS deployments and identify which release line each instance runs.
- Upgrade to 14.38.2, 15.64.0, or 16.18.0 or later, matching the deployed release line, using the project release guidance.
- Review application and database logs for malformed requests and unusual query patterns from low-privilege accounts.
- Audit which accounts exist, and remove stale employee, contractor, and test accounts that widen the attacker pool.
- Verify the deployed version after the upgrade and re-test the previously affected endpoints.
Management note
The barrier here is a login, and in an HR system almost everyone has one. Treat every account as a potential launch point, patch promptly, and pair the upgrade with a review of what data a successful extraction could have reached.