CVE-2026-108732: fallo de gravedad media en frappe hrms
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Publicada el · Actualizada el
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.3%
probabilidad de explotación
0.3%top 81% de las CVE
explotación observada
noninguna fuente lo reporta
1 exploit(s) público(s)
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
frappe · hrmsPoCs públicas encontradas — 1
cve_referencehackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracleno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — frappe hrms
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-54524HIGHFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportEPSS 0.5%CVE-2026-40888MEDIUMFrappe HR vulnerable to Improper Access ControlEPSS 0.4%CVE-2026-40889MEDIUMFrappe HR has Improper Access Control on FilesEPSS 0.4%CVE-2026-41320MEDIUMFrappe HR has possibility of SQL Injection due to improper field sanitizationEPSS 0.4%CVE-2026-45081MEDIUMFrappe HR: Permission Bypass in HRMS Leave Details APIEPSS 0.3%CVE-2026-55796MEDIUMFrappe HR: SQL Injection in HRMS Salary Payments via ECS ReportEPSS 0.3%
Referencias
https://github.com/frappe/hrmshttps://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81fhttps://github.com/frappe/hrms/releases/tag/v16.11.0https://hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oraclehttps://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oraclehttps://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount