Missing Authorization in Frappe HR's Leave Allocation Method
CVE-2026-108733

5.3MEDIUM

Key Information:

Vendor

Frappe

Status
Hrms
Vendor
CVE Published:
11 October 2026

What is CVE-2026-108733?

Frappe HR versions before 16.11.0 exhibit a significant security flaw in the expire_allocation method, which lacks proper authorization checks. This vulnerability permits authenticated users to manipulate other employees' leave allocations by sending crafted POST requests, enabling them to reduce the leave balance of any targeted individual, first potentially compromising organizational integrity and fairness in leave management.

Affected Version(s)

hrms 0 < 16.11.0

References

https://hackmd.io/@haind03/frappe-hrms-expire-allocation-...
third-party-advisory
https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b...
technical-description
https://github.com/frappe/hrms/commit/6ab7a50347367413b78...
patch

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
.