CVE-2026-108732— Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Quick assessment
Affected
frappe hrms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe HR (hrms) 在 16.11.0 版本之前的所有版本（包括所有 14.x 和 15.x 版本，最高至 15.64.3）中存在一个缺失授权漏洞。该漏洞存在于被标记为白名单的 方法中，允许已认证的用户读取薪资相关金额信息。 没有 HR 角色权限的攻击者可以通过调用 接口，并利用可枚举的工资单（Salary Slip）或报销（claim）文档名称，获取其他员工的净薪以及贷款、预支款和报销余额等敏感信息。
Possible ATT&CK Techniques 1 AI
T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108732
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108732
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108732
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108732 (2)
Vendor Advisories for CVE-2026-108732 (1)
News Coverage for CVE-2026-108732 (1)
Vendor Pages for CVE-2026-108732 (1)
Same Patch Batch · frappe · 2026-10-11 · 3 CVEs total
| CVE-2026-108734 | 4.3 MEDIUM | Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document |
| CVE-2026-108733 | 4.3 MEDIUM | Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation |
IV. Related Vulnerabilities
Same product: hrms
-
CVE-2026-108733
Frappe HR (hrms) before 16.11.0 Missing Authorization via ex -
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Pa -
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API -
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper f -
CVE-2026-40889
Frappe HR has Improper Access Control on Files
Same vendor: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes
Same weakness: CWE-862
-
CVE-2026-100404
Zulip: Guests can read new messages in non-subscribed public -
CVE-2026-91156
Discourse: Chat MessageBus delivers read-restricted messages -
CVE-2026-110629
VentureDrake Laravel CRM before 2.4.0 Missing Authorization -
CVE-2026-110624
Papermerge Core through 3.5.3 Missing Authorization via /tag -
CVE-2026-110623
Papermerge Core through 3.5.3 Missing Authorization in Share
V. Comments for CVE-2026-108732
No comments yet