CVE-2026-101006Medium· 4.3▾ SunlitA flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipul…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-54410Medium· 4.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check
CVE-2026-109376Medium· 4.3ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated portal users view project Timesheets
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
CVE-2026-115717High· 7.7Frappe Builder before 1.36.1 SSRF via convert_to_webp
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
CVE-2026-115720Medium· 5.0Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect