CVE-2026-108732 Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method wit...