CVE-2026-101006: Frappe HR authorization bypass in API functions

CVE-2026-101006 · Severity: medium · CVSS 4.3 · Published 2026-09-28

Frappe HR, a human resources and payroll management system, contains an authorization flaw in API functions that retrieve expense claims, shift requests, and attendance records. An attacker can bypass permission checks by manipulating the employee parameter, potentially accessing sensitive HR data belonging to other employees without proper authorization.

Technologies: Frappe HR. Vendors: Frappe.

Quick answers

Is CVE-2026-101006 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-101006 being exploited in the wild.
How severe is CVE-2026-101006?
Medium severity, with a CVSS score of 4.3, published 28 September 2026.
Which products and versions are affected?
Frappe HR up to 16.15.0.
Is there a fix for CVE-2026-101006?
A patch was published: Vendor confirmed fix has been released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101006 attacked?
It is attacked over the network.
Am I affected by CVE-2026-101006?
Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in hrms/api/__init__.py within the get_expense_claims, get_shift_requests, and get_attendance_requests functions due to insufficient permission validation on the employee parameter. An authenticated remote attacker can manipulate this parameter to access HR records of other employees, bypassing authorization controls. A patch has been released by the vendor.

Affected products

  • Frappe HR up to 16.15.0

Timeline

  • 2026-09-28: disclosed
  • patched: Vendor confirmed fix has been released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.