CVE-2026-121442— Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Quick assessment

Affected

frappe hrms

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 15.61.0 版本之前的 Frappe HRMS 中存在一个权限绕过漏洞，由于授权检查不当，已认证的员工可以查看其他员工的费用预支详情。攻击者可通过查询“费用报销预支”API 接口，获取属于其他员工的费用预支记录，从而泄露敏感的财务信息。

CVSS 4.3 · Medium Updated Nov 03, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Source: CVE Program / CVE List V5

Vulnerability Description

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
frappe	hrms	0 ~ 15.61.0	-

II. Public POCs for CVE-2026-121442

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121442

请登录查看更多情报信息。

Other References for CVE-2026-121442 (2)

https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6 vendor-advisory
https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121442

IV. Related Vulnerabilities

Same product: hrms

Same vendor: frappe

Same weakness: CWE-639