CVE-2026-101006
Received Received - Intake

Authorization Bypass in Frappe HR via Employee Parameter

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-101006
EUVD
EUVD-2026-88097

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe hr to 16.15.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in Frappe HR versions up to 16.15.0. It involves incorrect authorization due to improper permission validation in functions like get_expense_claims, get_shift_requests, and get_attendance_requests. The flaw allows manipulation of the employee argument, enabling unauthorized access to sensitive data.

Impact Analysis

An attacker could exploit this to access or modify employee-related data without proper authorization. This may lead to unauthorized viewing of sensitive information like expense claims, shift details, or attendance records, potentially causing data breaches or compliance violations.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using affected Frappe HR versions may face compliance penalties or legal consequences.

Mitigation Strategies

Update Frappe HR to the latest version where the vulnerability has been fixed. The vendor has already addressed the issue as per their response.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101006. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart