Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-64862 (GCVE-0-2026-64862)

Vulnerability from nvd – Published: 2026-10-16 20:52 – Updated: 2026-10-16 20:52

Title

Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM
https://github.com/frappe/hrms/commit/6214ec8db13…	x_refsource_MISC
https://github.com/frappe/hrms/commit/eefb8f4552d…	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v15.58.3	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.4.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 15.58.3 Affected: >= 16.0.0, < 16.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.58.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c 16.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T20:52:53.666Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-wfc6-cw72-cvhx"
        },
        {
          "name": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/commit/6214ec8db13c587e05150bdf3e4e9e5d28b7fd94"
        },
        {
          "name": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/commit/eefb8f4552d0e1e09ee4abae4fdc76fc5473e00a"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v15.58.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v15.58.3"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v16.4.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.4.3"
        }
      ],
      "source": {
        "advisory": "GHSA-wfc6-cw72-cvhx",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64862",
    "datePublished": "2026-10-16T20:52:53.666Z",
    "dateReserved": "2026-07-20T18:31:39.291Z",
    "dateUpdated": "2026-10-16T20:52:53.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55796 (GCVE-0-2026-55796)

Vulnerability from nvd – Published: 2026-10-16 20:50 – Updated: 2026-10-16 20:50

Title

Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM
https://github.com/frappe/hrms/commit/d823d20c494…	x_refsource_MISC
https://github.com/frappe/hrms/commit/e9eef454250…	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v15.60.3	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.7.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 15.60.3 Affected: >= 16.0.0, < 16.7.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.60.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 16.0.0, \u003c 16.7.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The affected Salary Payments via ECS report allows the user to inject SQL through report filter values. Successful exploitation can access sensitive database records. This issue is fixed in versions 15.60.3 and 16.7.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T20:50:01.927Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-c32r-q985-64xr"
        },
        {
          "name": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/commit/d823d20c49493c2959e809d41c862c037c8109e6"
        },
        {
          "name": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/commit/e9eef45425072b4e3cefea71683d515d63906d66"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v15.60.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v15.60.3"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v16.7.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.7.1"
        }
      ],
      "source": {
        "advisory": "GHSA-c32r-q985-64xr",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55796",
    "datePublished": "2026-10-16T20:50:01.927Z",
    "dateReserved": "2026-06-17T14:40:28.380Z",
    "dateUpdated": "2026-10-16T20:50:01.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-111389 (GCVE-0-2026-111389)

Vulnerability from nvd – Published: 2026-10-16 01:17 – Updated: 2026-10-16 01:17

Title

Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

Summary

Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database.

Severity

8.3 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	vendor-advisory
https://www.vulncheck.com/advisories/frappe-hrms-…	third-party-advisory

Impacted products

3 products

Vendor	Product	Version
frappe	hrms	Affected: 14.0.0 , < 14.38.2 (semver) Unaffected: 14.38.2 (semver)
frappe	hrms	Affected: 15.0.0 , < 15.64.0 (semver) Unaffected: 15.64.0 (semver)
frappe	hrms	Affected: 16.0.0 , < 16.18.0 (semver) Unaffected: 16.18.0 (semver)

Date Public

2026-10-01 00:00

Credits

utkusen asmitahase

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "14.38.2",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "14.38.2",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "15.64.0",
              "status": "affected",
              "version": "15.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "15.64.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "16.18.0",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "16.18.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "utkusen"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "asmitahase"
        }
      ],
      "datePublic": "2026-10-01T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-16T01:17:57.752Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jfmr-9jv9-mrw4)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-jfmr-9jv9-mrw4"
        },
        {
          "name": "VulnCheck Advisory: Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-hrms-14.0.0-before-14.38.2-sql-injection-via-missing-validation"
        }
      ],
      "title": "Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-111389",
    "datePublished": "2026-10-16T01:17:57.752Z",
    "dateReserved": "2026-10-15T21:55:44.538Z",
    "dateUpdated": "2026-10-16T01:17:57.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108733 (GCVE-0-2026-108733)

Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-11 12:19

Title

Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Summary

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

6 references

URL	Tags
https://hackmd.io/@haind03/frappe-hrms-expire-all…	third-party-advisory
https://github.com/frappe/hrms/blob/0a54d2c7b8b60…	technical-description
https://github.com/frappe/hrms/commit/6ab7a503473…	patch
https://github.com/frappe/hrms/releases/tag/v16.11.0	release-notes
https://github.com/frappe/hrms	product
https://www.vulncheck.com/advisories/frappe-hr-hr…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: 0 , < 16.11.0 (semver) cpe:2.3:a:frappe:frappe_hr::::::::

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/frappe/hrms",
          "product": "hrms",
          "repo": "https://github.com/frappe/hrms",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "16.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee\u0027s Leave Allocation in a POST request to zero its allocated leaves and wipe that employee\u0027s remaining leave balance."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:40.218Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/frappe-hrms-expire-allocation-missing-authorization-20261010"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/leave_ledger_entry/leave_ledger_entry.py#L199-L228"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81f"
        },
        {
          "name": "hrms v16.11.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.11.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/frappe/hrms"
        },
        {
          "name": "VulnCheck Advisory: Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-expire-allocation"
        }
      ],
      "title": "Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108733",
    "datePublished": "2026-10-11T12:19:40.218Z",
    "dateReserved": "2026-10-11T01:52:48.083Z",
    "dateUpdated": "2026-10-11T12:19:40.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-108732 (GCVE-0-2026-108732)

Vulnerability from nvd – Published: 2026-10-11 12:19 – Updated: 2026-10-13 19:48

Title

Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

Summary

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 19:47 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6373 records in the last 180 days details

References

7 references

URL	Tags
https://hackmd.io/@haind03/frappe-hrms-fnf-payrol…	third-party-advisory
https://github.com/frappe/hrms/blob/0a54d2c7b8b60…	technical-description
https://github.com/frappe/hrms/commit/6ab7a503473…	patch
https://github.com/frappe/hrms/releases/tag/v16.11.0	release-notes
https://github.com/frappe/hrms	product
https://www.vulncheck.com/advisories/frappe-hr-hr…	third-party-advisory
https://hackmd.io/@haind03/cve-2026-108732-frappe…	exploit

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: 0 , < 16.11.0 (semver) cpe:2.3:a:frappe:frappe_hr::::::::

Date Public

2026-10-10 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108732",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T19:47:51.638445Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T19:48:14.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracle"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/frappe/hrms",
          "product": "hrms",
          "repo": "https://github.com/frappe/hrms",
          "vendor": "frappe",
          "versions": [
            {
              "lessThan": "16.11.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "16.11.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees\u0027 net pay and loan, advance, and claim balances."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-11T12:19:39.612Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oracle"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81f"
        },
        {
          "name": "hrms v16.11.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.11.0"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/frappe/hrms"
        },
        {
          "name": "VulnCheck Advisory: Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount"
        }
      ],
      "title": "Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-108732",
    "datePublished": "2026-10-11T12:19:39.612Z",
    "dateReserved": "2026-10-11T01:52:47.743Z",
    "dateUpdated": "2026-10-13T19:48:14.692Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-54524 (GCVE-0-2026-54524)

Vulnerability from nvd – Published: 2026-09-17 18:33 – Updated: 2026-09-17 19:00

Title

Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 19:00 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM
https://github.com/frappe/hrms/pull/4515	x_refsource_MISC
https://github.com/frappe/hrms/commit/b1614853195…	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.7.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 16.7.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54524",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T19:00:29.502131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T19:00:53.087Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.7.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-17T18:33:37.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-2gv7-x4h2-3737"
        },
        {
          "name": "https://github.com/frappe/hrms/pull/4515",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/pull/4515"
        },
        {
          "name": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/commit/b16148531954531a448dafdff20dc61882430ee9"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v16.7.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.7.0"
        }
      ],
      "source": {
        "advisory": "GHSA-2gv7-x4h2-3737",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54524",
    "datePublished": "2026-09-17T18:33:37.558Z",
    "dateReserved": "2026-06-15T18:40:01.651Z",
    "dateUpdated": "2026-09-17T19:00:53.087Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45081 (GCVE-0-2026-45081)

Vulnerability from nvd – Published: 2026-05-27 17:18 – Updated: 2026-05-27 18:26

Title

Frappe HR: Permission Bypass in HRMS Leave Details API

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-27 18:25 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 16.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T18:25:16.494173Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T18:26:47.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees\u2019 leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T17:18:53.600Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-9jpf-5vrm-hpcj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-9jpf-5vrm-hpcj"
        }
      ],
      "source": {
        "advisory": "GHSA-9jpf-5vrm-hpcj",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR: Permission Bypass in HRMS Leave Details API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45081",
    "datePublished": "2026-05-27T17:18:53.600Z",
    "dateReserved": "2026-05-08T18:45:10.097Z",
    "dateUpdated": "2026-05-27T18:26:47.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41320 (GCVE-0-2026-41320)

Vulnerability from nvd – Published: 2026-04-21 19:34 – Updated: 2026-04-22 13:42

Title

Frappe HR has possibility of SQL Injection due to improper field sanitization

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn't otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 13:41 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 15.54.0 Affected: < 14.38.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:41:45.488033Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:42:48.215Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.54.0"
            },
            {
              "status": "affected",
              "version": "\u003c 14.38.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1, a specially crafted request made to a certain endpoint could result in SQL injection, allowing an attacker to extract information they wouldn\u0027t otherwise be able to. Versions 15.54.0 and 14.38.1 contain a patch. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:34:16.753Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-745c-5q8r-vgj2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-745c-5q8r-vgj2"
        }
      ],
      "source": {
        "advisory": "GHSA-745c-5q8r-vgj2",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR has possibility of SQL Injection due to improper field sanitization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-41320",
    "datePublished": "2026-04-21T19:34:16.753Z",
    "dateReserved": "2026-04-20T14:01:46.671Z",
    "dateUpdated": "2026-04-22T13:42:48.215Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40889 (GCVE-0-2026-40889)

Vulnerability from nvd – Published: 2026-04-21 19:32 – Updated: 2026-04-22 13:30

Title

Frappe HR has Improper Access Control on Files

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-22 13:29 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM
https://github.com/frappe/hrms/releases/tag/v15.58.2	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.4.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 16.4.2 Affected: < 15.58.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40889",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-22T13:29:58.366920Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-22T13:30:10.795Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 16.4.2"
            },
            {
              "status": "affected",
              "version": "\u003c 15.58.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:32:52.106Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-6cg5-4q6m-vrgm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-6cg5-4q6m-vrgm"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v15.58.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v15.58.2"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v16.4.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.4.2"
        }
      ],
      "source": {
        "advisory": "GHSA-6cg5-4q6m-vrgm",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR has Improper Access Control on Files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40889",
    "datePublished": "2026-04-21T19:32:52.106Z",
    "dateReserved": "2026-04-15T16:37:22.766Z",
    "dateUpdated": "2026-04-22T13:30:10.795Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-40888 (GCVE-0-2026-40888)

Vulnerability from nvd – Published: 2026-04-21 19:28 – Updated: 2026-04-21 19:43

Title

Frappe HR vulnerable to Improper Access Control

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Severity

6.5 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-21 19:43 UTC

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7771 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/frappe/hrms/security/advisorie…	x_refsource_CONFIRM
https://github.com/frappe/hrms/releases/tag/v15.58.1	x_refsource_MISC
https://github.com/frappe/hrms/releases/tag/v16.4.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
frappe	hrms	Affected: < 15.58.1 Affected: < 16.4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-40888",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T19:43:31.343136Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T19:43:37.506Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "hrms",
          "vendor": "frappe",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 15.58.1"
            },
            {
              "status": "affected",
              "version": "\u003c 16.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-21T19:28:28.849Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v15.58.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v15.58.1"
        },
        {
          "name": "https://github.com/frappe/hrms/releases/tag/v16.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/frappe/hrms/releases/tag/v16.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-4375-7rxj-9hfx",
        "discovery": "UNKNOWN"
      },
      "title": "Frappe HR vulnerable to Improper Access Control"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-40888",
    "datePublished": "2026-04-21T19:28:28.849Z",
    "dateReserved": "2026-04-15T16:37:22.765Z",
    "dateUpdated": "2026-04-21T19:43:37.506Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities found for hrms by frappe

CVE-2026-64862 (GCVE-0-2026-64862)

CVE-2026-55796 (GCVE-0-2026-55796)

CVE-2026-111389 (GCVE-0-2026-111389)

CVE-2026-108733 (GCVE-0-2026-108733)

CVE-2026-108732 (GCVE-0-2026-108732)

CVE-2026-54524 (GCVE-0-2026-54524)

CVE-2026-45081 (GCVE-0-2026-45081)

CVE-2026-41320 (GCVE-0-2026-41320)

CVE-2026-40889 (GCVE-0-2026-40889)

CVE-2026-40888 (GCVE-0-2026-40888)