CVE-2026-108732

EUVD-2026-96898
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 18.6%
Common Weakness Enumeration
References
https://github.com/frappe/hrms
https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327
https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81f
https://github.com/frappe/hrms/releases/tag/v16.11.0
https://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oracle
https://www.vulncheck.com/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount