GHSA-9f7p-ppw4-57p6: Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
Published Nov 3, 2026
·Updated
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.
Event History
Nov 3, 2026
CVE Published
via OSV·02:28 PM
Data Sourced
via OSV·02:28 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated employee can exploit it. No additional privileges or user interaction are required.
2
What information could be exposed?
An attacker can retrieve expense advance records belonging to other employees, exposing sensitive financial information.
3
Which versions need remediation?
Frappe HRMS versions before 15.61.0 are affected. Upgrade to 15.61.0 or a later version.