Permission Bypass Vulnerability in Frappe HRMS Affects Employee Expense Records

CVE-2026-121442

What is CVE-2026-121442?

Frappe HRMS prior to version 15.61.0 contains a vulnerability that enables authenticated employees to bypass authorization checks and access sensitive information. Specifically, the flaw allows users to retrieve other employees' expense advance details via the Expense Claim Advances API. This exposure could lead to unauthorized viewing of sensitive financial information, representing a significant risk to the confidentiality of employee data.

References