---
id: CVE-2026-121442
title: Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
summary: >-
  Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that
  allows authenticated employees to view other employees' expense advance
  details due to improper authorization checks. Attackers can query the Expense
  Claim Advanc…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: frappe
product: hrms
affected:
  - hrms < 15.61.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:03:01.098504Z'
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:03:18.271Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121442'
references:
  - url: 'https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6'
    label: GitHub Security Advisory (GHSA-9f7p-ppw4-57p6)
  - url: >-
      https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api
    label: >-
      VulnCheck Advisory: Frappe HRMS before 15.61.0 Permission Bypass via
      Expense Claim Advances API
tags:
  - cve.org
epss: 0.00182
epssPercentile: 0.07873
ingestedAt: '2026-11-05T19:30:42.971Z'
---

## Overview

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

## Affected

- `hrms < 15.61.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.