CVE-2026-108732 frappe CVE debrief

Who should care

Defenders responsible for Frappe HR (hrms) deployments should assess exposure and apply the patch if necessary. This includes administrators and security teams managing Frappe HR (hrms) instances.

Why it matters

CVE-2026-108732 is a missing authorization vulnerability in Frappe HR (hrms) before version 16.11.0 that allows authenticated users to read payroll amounts of other employees. Defenders should prioritize verifying exposure and applying the patch.

• Defenders need to verify exposure and apply the patch to prevent unauthorized access to sensitive employee data.
• The vulnerability allows authenticated users to read payroll amounts of other employees, potentially leading to data breaches.
• Defenders should monitor for suspicious activity on the system to detect potential exploitation.

Technical summary

The vulnerability is caused by a missing authorization check in the get_account_and_amount method of Frappe HR (hrms) before version 16.11.0. This allows authenticated users to read payroll amounts of other employees by calling the method over /api/method with enumerable Salary Slip or claim document names. The issue arises from inadequate access controls, potentially leading to unauthorized data access. Defenders should prioritize verifying exposure and applying the patch to prevent data breaches and maintain system security.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch, as the vulnerability allows unauthorized access to sensitive employee data.

Recommended defensive actions

• Verify if the system is running a version of Frappe HR (hrms) before 16.11.0 and apply the patch if necessary.
• Restrict access to the /api/method endpoint to prevent unauthorized calls.
• Monitor for suspicious activity on the system.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is confirmed in Frappe HR (hrms) before version 16.11.0, including all 14.x and 15.x releases through 15.64.3. The CVE record and source item provide details on the vulnerability. Evidence is based on source-provided information and may not cover all potential impacts or affected configurations. Defenders should verify exposure in their specific environments and review official advisories for detailed guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.