CVE-2026-108733: Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expireallocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HR (hrms)to a version that resolves this vulnerability.Fixed in 16.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated Frappe HR user can exploit it, including users without HR roles. The attacker needs to be able to submit a POST request naming another employee's Leave Allocation.
Which releases are affected?
All 14.x releases and 15.x releases through 15.64.3 are affected, as are other versions before 16.11.0. Version 16.11.0 is the first version identified as not affected.
What is the impact of a successful exploit?
An attacker can expire another employee's leave allocation, setting its allocated leave to zero. This can wipe the employee's remaining leave balance.