CVE-2026-64862

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-55796

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

EUVD-2026-103173

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862

The open-source human resources management solution Frappe HR is vulnerable to a missing authorization flaw (CWE-862) in its PWA API endpoints . Versions prior to 15.58.3 and 16.4.3 do not consistently authorize employee-specific PWA API requests, allowing an authenticated user to request and acc...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-55796

Frappe HR, an open-source human resources management solution, contains a SQL Injection vulnerability in the Salary Payments via ECS report component. The flaw exists because the application constructs report conditions using unsafe SQL string interpolation . An authenticated HR user can supply c...

CVE-2026-55796 Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

EUVD-2026-103172

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

CVE-2026-55796 Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

CVE-2026-55796: Improper Neutralization of Special Elements used in an SQL Command

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

CVE-2026-108733

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108732

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733

Frappe HR (hrms) versions before 16.11.0 , including all 14.x and 15.x releases through 15.64.3 , are vulnerable to a missing authorization flaw in the whitelisted expire_allocation method. This vulnerability allows authenticated users who lack HR roles to target another employee's Leave Allocati...

EUVD-2026-96899

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108732 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...

CVE-2026-108732 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...

CVE-2026-108732

The Frappe HR (hrms) application before version 16.11.0 (including all 14.x and 15.x releases through 15.64.3 ) contains a missing authorization vulnerability. The flaw exists in the whitelisted get_account_and_amount method, which allows authenticated users without HR roles to access sensitive d...