CVE-2026-108732
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
frappe hrms
CVSS
5.3MediumExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 13 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 16.11.0hrmsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
Text from CVE List
Affected versions 1
- hrmsaffected: all versions before 16.11.0CVE List
References 7
- github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81fFixvia CVE List
- github.com/frappe/hrms/releases/tag/v16.11.0Fixvia CVE List
- hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oracleAdvisoryvia CVE List
- vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amountAdvisoryvia CVE List
- hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracleExploitvia CVE List
- github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327Referencevia CVE List
- github.com/frappe/hrmsReferencevia CVE List