CVE-2026-121442
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.
Risk Assessment
An organization may experience leakage of sensitive employee financial data. This can breach privacy and trust and lead to compliance violations.
Recommendation
Update Frappe HRMS to version 15.61.0 or later. Review and strengthen authorization mechanisms in the API.
Other vulnerabilities in Frappe HRMS
Original NVD description (English source)
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS