All vulnerabilities
CVE-2026-101006

HR: Frappe HR Permission Validation __init__.py get_attendance_requests authorization

Frappe HR
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published28 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."

Text from CVE List

Affected versions 16

  • HRaffected: 16.0CVE List
  • HRaffected: 16.1CVE List
  • HRaffected: 16.2CVE List
  • HRaffected: 16.3CVE List
  • HRaffected: 16.4CVE List
  • HRaffected: 16.5CVE List
  • HRaffected: 16.6CVE List
  • HRaffected: 16.7CVE List
  • HRaffected: 16.8CVE List
  • HRaffected: 16.9CVE List
  • HRaffected: 16.10CVE List
  • HRaffected: 16.11CVE List
  • HRaffected: 16.12CVE List
  • HRaffected: 16.13CVE List
  • HRaffected: 16.14CVE List
  • HRaffected: 16.15.0CVE List

References 4