CVE-2026-64862

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862

The open-source human resources management solution Frappe HR is vulnerable to a missing authorization flaw (CWE-862) in its PWA API endpoints . Versions prior to 15.58.3 and 16.4.3 do not consistently authorize employee-specific PWA API requests, allowing an authenticated user to request and acc...

EUVD-2026-103173

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862 Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

PT-2026-116159

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-64862: Missing Authorization

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

Frappe HR Authorization Issue Vulnerability

Versions of Frappe HR prior to 15.58.3 and from 16.0.0 to 16.4.3 have an authorization issue. This issue arises because the HRMS PWA API endpoints do not perform consistent authorization checks for PWA API requests specific to individual employees. As a result, authenticated users may access...