CVE-2026-108733— Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Quick assessment
Affected
frappe hrms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Frappe HR（hrms）在版本 16.11.0 之前，包括所有 14.x 和 15.x 版本（最高至 15.64.3），存在一个缺失授权验证的漏洞。该漏洞位于被白名单保护的 方法中，允许已认证用户使任何休假配额失效。没有 HR 角色的攻击者可以在 POST 请求中指定另一名员工的休假配额，从而将其已分配的休假天数归零，并清除该员工剩余的休假余额。
Possible ATT&CK Techniques 1 AI
T1136.001 · Local Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108733
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Source: CVE Program / CVE List V5
Vulnerability Description
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-108733
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108733
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108733 (2)
Vendor Advisories for CVE-2026-108733 (1)
Security Blog Posts for CVE-2026-108733 (1)
-
🔗 404 Not Found - HackMD third-party-advisory
Vendor Pages for CVE-2026-108733 (1)
Same Patch Batch · frappe · 2026-10-11 · 3 CVEs total
| CVE-2026-108734 | 4.3 MEDIUM | Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document |
| CVE-2026-108732 | 4.3 MEDIUM | Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount |
IV. Related Vulnerabilities
Same product: hrms
-
CVE-2026-108732
Frappe HR (hrms) before 16.11.0 Missing Authorization via ge -
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Pa -
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API -
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper f -
CVE-2026-40889
Frappe HR has Improper Access Control on Files
Same vendor: frappe
-
CVE-2026-55823
Frappe: Possibility of SQL injection in reportview -
CVE-2026-66057
Frappe: Open Redirect via Unsanitized OAuth State Param. -
CVE-2026-109675
Frappe Suite before commit 2697564 Broken Access Control in -
CVE-2026-109674
Frappe ERPNext before 16.6.0 SQL Injection via Missing Input -
CVE-2026-109672
Frappe ERPNext before 15.118.0 Missing Authorization Exposes
Same weakness: CWE-862
-
CVE-2026-17092
Directorist: AI-Powered Business Directory, Listings & Class -
CVE-2026-103423
Booking Package <= 1.7.29 - Missing Authorization to Unauthe -
CVE-2026-110160
Chrome <155.0.8059.79 缺少授权漏洞 -
CVE-2026-63172
Omnispace Agora Project < 26.10.0 Broken Function-Level Auth -
CVE-2026-63174
Omnispace Agora Project < 26.10.0 Broken Access Control via
V. Comments for CVE-2026-108733
No comments yet