Missing Authorization Vulnerability in Frappe HR by Frappe
CVE-2026-108732

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Hrms
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108732?

Frappe HR versions before 16.11.0, including all 14.x and 15.x releases up to 15.64.3, have a vulnerability where the get_account_and_amount method lacks proper authorization checks. This flaw permits authenticated users—lacking HR roles—to access sensitive payroll information by calling the method via the API with document names. Consequently, this can lead to unauthorized disclosure of other employees' net pay, loans, advances, and claim balances, presenting significant privacy and security risks.

Affected Version(s)

hrms 0 < 16.11.0

References

https://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount...
third-party-advisory
https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b...
technical-description
https://github.com/frappe/hrms/commit/6ab7a50347367413b78...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.