CVEvulnerability
CVE-2026-40888
6.5 MEDIUM
Official page ↗
- Status
- Analyzed
- Published
- 2026-04-21
- Last modified
- 2026-10-25
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.5 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-284
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.
Affected configurations
• frappe frappe hr (< 15.58.1)
• frappe frappe hr (>= 16.0.0 < 16.4.1)
Related
Weakness · CWE (1)
- CWE-284 Improper Access Control weakness
References
- https://github.com/frappe/hrms/releases/tag/v15.58.1 Release Notes
- https://github.com/frappe/hrms/releases/tag/v16.4.1 Release Notes
- https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx Vendor Advisory