CVE-2026-108732

The Frappe HR (hrms) application before version 16.11.0 (including all 14.x and 15.x releases through 15.64.3 ) contains a missing authorization vulnerability. The flaw exists in the whitelisted get_account_and_amount method, which allows authenticated users without HR roles to access sensitive d...