CVE-2026-108732: falha de média gravidade em frappe hrms
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Publicada em · Atualizada em
33Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3epss 0.3%
probabilidade de exploração
0.3%top 81% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
frappe · hrmsPoCs públicas encontradas — 1
cve_referencehackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oraclenão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — frappe hrms
No mesmo produto, das mais perigosas para as menos.
CVE-2026-54524HIGHFrappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode ReportEPSS 0.5%CVE-2026-40888MEDIUMFrappe HR vulnerable to Improper Access ControlEPSS 0.4%CVE-2026-40889MEDIUMFrappe HR has Improper Access Control on FilesEPSS 0.4%CVE-2026-41320MEDIUMFrappe HR has possibility of SQL Injection due to improper field sanitizationEPSS 0.4%CVE-2026-45081MEDIUMFrappe HR: Permission Bypass in HRMS Leave Details APIEPSS 0.3%CVE-2026-55796MEDIUMFrappe HR: SQL Injection in HRMS Salary Payments via ECS ReportEPSS 0.3%
Referências
https://github.com/frappe/hrmshttps://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81fhttps://github.com/frappe/hrms/releases/tag/v16.11.0https://hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oraclehttps://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oraclehttps://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount