Permission Bypass in Frappe HRMS Exposes Expense Data

Executive Summary

Frappe HRMS before version 15.61.0 has a permission bypass flaw in the Expense Claim Advances API. Authenticated employees can view other employees' expense advance details due to improper authorization checks. This allows unauthorized access to sensitive financial information through API queries.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor API requests to the Expense Claim Advances endpoint for unauthorized access patterns. Check for repeated queries from authenticated employees accessing records not belonging to them. Review server logs for suspicious activity related to the /api/method/expense_claim.get_list or similar endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with valid credentials to access other employees' expense advance records. This exposes sensitive financial data, potentially leading to misuse of personal or company financial information. The impact includes privacy breaches and financial data leaks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal financial data and HIPAA if employee health-related expense data is exposed. It breaches data protection principles requiring strict access controls and confidentiality of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Frappe HRMS to version 15.61.0 or later to patch the vulnerability. If immediate updating is not possible, restrict access to the Expense Claim Advances API by implementing stricter authorization checks or temporarily disabling the API until the update is applied.

Useful 0 Not Useful 0