CVE Feed

    Dashboard / CVE / CVE-2026-121442

    CVE-2026-121442

    Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

    Published:Nov 3, 2026
    Last Modified:Nov 3, 2026
    EPS:Nov 3, 2026
    EPSS Score:
    CVSS Score:4.3

    Affected Products

    Vendor
    Frappe
    Product
    Hrms

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-64862 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA …
    CVE-2026-55796 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salar…
    CVE-2026-111389 (CVSS 8.3) — Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnera…
    CVE-2026-108732 (CVSS 5.3) — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth…
    CVE-2026-54524 (CVSS 7.1) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user…
    CVE-2026-45081 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employe…
    CVE-2026-41320 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1,…
    CVE-2026-40889 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, …
    CVE-2026-40888 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High