Quick answers
- Is CVE-2026-45081 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45081 being exploited in the wild.
- How severe is CVE-2026-45081?
- Medium severity, with a CVSS score of 6.5, published 27 May 2026.
- Which products and versions are affected?
- Frappe HR < 16.5.0.
- Is there a fix for CVE-2026-45081?
- A patch was published on 2026-05-27: Vulnerability fixed in version 16.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-45081 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-45081?
- Check whether you run Frappe HR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Frappe HR (HRMS) Leave Details API. The application failed to properly validate that the requesting user had the necessary permissions or ownership to view specific leave records. An authenticated attacker with low-level employee privileges could exploit this over the network to bypass access controls and retrieve sensitive leave information of other employees. The issue is resolved in version 16.5.0 by enforcing strict employee-level access validation on the affected API endpoint.
Affected products
- Frappe HRMS (Frappe HR) < 16.5.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: NVD publication date
- 2026-05-27: patched: Vulnerability fixed in version 16.5.0