CVE-2026-108733

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

EUVD-2026-96899

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733

Frappe HR (hrms) versions before 16.11.0 , including all 14.x and 15.x releases through 15.64.3 , are vulnerable to a missing authorization flaw in the whitelisted expire_allocation method. This vulnerability allows authenticated users who lack HR roles to target another employee's Leave Allocati...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

CVE-2026-108733: Missing Authorization

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

PT-2026-110136

Name of the Vulnerable Software and Affected Versions Frappe HR hrms versions 14.x through 15.64.3 Frappe HR hrms versions prior to 16.11.0 Description An authorization flaw exists in the whitelisted expire allocation method. This allows authenticated users who do not possess HR roles to expire a...