Executive brief
Frappe HR is an open-source human resources management system used by organizations to manage employee data and leave requests. A security flaw allowed authenticated employees to view the private leave details of their colleagues without authorization. This could lead to the exposure of sensitive personal information and medical-related absence data within the company.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the Frappe HR (HRMS) Leave Details API. The application failed to properly validate that the requesting user had the necessary permissions or ownership to view specific leave records. An authenticated attacker with low-level employee privileges could exploit this over the network to bypass access controls and retrieve sensitive leave information of other employees. The issue is resolved in version 16.5.0 by enforcing strict employee-level access validation on the affected API endpoint.
Affected products
- Frappe HRMS (Frappe HR) < 16.5.0
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: NVD publication date
- 2026-05-27: patched: Vulnerability fixed in version 16.5.0