CVE Feed

    Dashboard / CVE / CVE-2026-64862

    CVE-2026-64862

    Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.

    Published:Oct 16, 2026
    Last Modified:Oct 19, 2026
    EPS:Oct 16, 2026
    EPSS Score:0.00238
    CVSS Score:6.5

    Affected Products

    Vendor
    Frappe
    Product
    Hrms

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-121442 (CVSS 5.3) — Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to v…
    CVE-2026-55796 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salar…
    CVE-2026-111389 (CVSS 8.3) — Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnera…
    CVE-2026-108732 (CVSS 5.3) — Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing auth…
    CVE-2026-54524 (CVSS 7.1) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user…
    CVE-2026-45081 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employe…
    CVE-2026-41320 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.54.0 and 14.38.1,…
    CVE-2026-40889 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, …
    CVE-2026-40888 (CVSS 6.5) — Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High