CVE-2026-108733

Frappe HR (hrms) versions before 16.11.0 , including all 14.x and 15.x releases through 15.64.3 , are vulnerable to a missing authorization flaw in the whitelisted expire_allocation method. This vulnerability allows authenticated users who lack HR roles to target another employee's Leave Allocati...

CVE-2026-108733 Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...

EUVD-2026-96899

Frappe HR hrms before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Lea...