CVE-2026-108732: Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Published Oct 11, 2026
·Updated
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted getaccountandamount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
Affected Software
1 affected component
Frappe Frappe HR (hrms)<16.11.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HR (hrms)to a version that resolves this vulnerability.Fixed in 16.11.0
Event History
Oct 11, 2026
CVE Published
via MITRE·12:19 PM
Data Sourced
via MITRE·12:19 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness