CVE-2026-108732: Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HR (hrms)to a version that resolves this vulnerability.Fixed in 16.11.0
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe HR (hrms) releases before 16.11.0 are affected, including all 14.x releases and 15.x releases through 15.64.3.
What access does an attacker need?
The attacker needs an authenticated Frappe HR account, but does not need an HR role. They can invoke the whitelisted method through the /api/method endpoint.
What information can be disclosed?
An attacker can disclose other employees' net pay and loan, advance, and claim balances. Exploitation relies on enumerating Salary Slip or claim document names.