Is CVE-2026-108733 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-108733 being exploited in the wild.

How severe is CVE-2026-108733?

Medium severity, with a CVSS score of 4.3, published 11 October 2026.

Which products and versions are affected?

Frappe HR before 16.11.0, including all 14.x and 15.x through 15.64.3.

Is there a fix for CVE-2026-108733?

Yes: fixed in 16.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-108733 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-108733?

Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-108733: Frappe HR missing authorization in expire_allocation

CVE-2026-108733 · Severity: medium · CVSS 4.3 · Published 2026-10-11

Frappe HR is an open-source human resources and payroll management system. A missing authorization vulnerability allows any authenticated user—even those without HR permissions—to manipulate other employees' leave allocations by zeroing out their remaining leave balance. An attacker could render another employee unable to take leave or cause payroll and scheduling issues.

Technologies: Frappe HR. Vendors: Frappe.

Quick answers

Is CVE-2026-108733 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-108733 being exploited in the wild.
How severe is CVE-2026-108733?: Medium severity, with a CVSS score of 4.3, published 11 October 2026.
Which products and versions are affected?: Frappe HR before 16.11.0, including all 14.x and 15.x through 15.64.3.
Is there a fix for CVE-2026-108733?: Yes: fixed in 16.11.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-108733 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-108733?: Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 16.11.0

Technical details

The whitelisted expire_allocation method in Frappe HR lacks proper authorization checks, permitting authenticated users without HR roles to expire any leave allocation. An attacker can craft a POST request to name another employee's Leave Allocation and set its allocated leaves to zero. No authentication bypass is required—only a valid user account; exploitation is straightforward.

Affected products

Frappe HR before 16.11.0, including all 14.x and 15.x through 15.64.3

Timeline

2026-10-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.