CVE-2026-108732: medium-severity vulnerability in frappe hrms
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Published · Updated
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.3%
exploitation probability
0.3%top 81% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
frappe · hrmspublic PoCs found — 1
cve_referencehackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracleunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — frappe hrms
In the same product, most dangerous first.
CVE-2026-54524HIGHFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportEPSS 0.5%CVE-2026-40888MEDIUMFrappe HR vulnerable to Improper Access ControlEPSS 0.4%CVE-2026-40889MEDIUMFrappe HR has Improper Access Control on FilesEPSS 0.4%CVE-2026-41320MEDIUMFrappe HR has possibility of SQL Injection due to improper field sanitizationEPSS 0.4%CVE-2026-45081MEDIUMFrappe HR: Permission Bypass in HRMS Leave Details APIEPSS 0.3%CVE-2026-55796MEDIUMFrappe HR: SQL Injection in HRMS Salary Payments via ECS ReportEPSS 0.3%
References
https://github.com/frappe/hrmshttps://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81fhttps://github.com/frappe/hrms/releases/tag/v16.11.0https://hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oraclehttps://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oraclehttps://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount