CVE-2026-108733
Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
frappe hrms
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.26%Chance of exploitation activity in the next 30 days, higher than 16% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 16.11.0hrmsCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Text from CVE List
Affected versions 1
- hrmsaffected: all versions before 16.11.0CVE List
References 6
- github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81fFixvia CVE List
- github.com/frappe/hrms/releases/tag/v16.11.0Fixvia CVE List
- hackmd.io/@haind03/frappe-hrms-expire-allocation-missing-authorization-20261010Advisoryvia CVE List
- vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-expire-allocationAdvisoryvia CVE List
- github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/leave_ledger_entry/leave_ledger_entry.py#L199-L228Referencevia CVE List
- github.com/frappe/hrmsReferencevia CVE List