Insufficient Authorization in Frappe HR API for Employee Data Access

CVE-2026-64862

What is CVE-2026-64862?

Frappe HR, an open-source human resources management solution, has a vulnerability in its PWA API endpoints, which allows authenticated users to access and request sensitive employee data of other users without sufficient authorization checks. Prior to versions 15.58.3 and 16.4.3, the system did not consistently enforce proper authorization, leading to potential data breaches. This vulnerability could be exploited to compromise sensitive HR records, highlighting the need for immediate updates to secure employee data effectively.

References