CVE-2026-101006: frappe hr Improper Authorization

Vulnerability summary

CVE-2026-101006 is a medium (CVSS 5.3) Improper Authorization vulnerability in frappe hr. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.7% of scored vulnerabilities.

Timeline

1. 28-09-2026
   PublishedVulnerability first disclosed.
2. 01-10-2026
   Last modifiedVulnerability information updated.

Description

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.