CVE-2026-40888

EUVD-2026-24276
Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 12%
Affected Products (NVD)
VendorProductVersion
frappefrappe_hr
𝑥
< 15.58.1
frappefrappe_hr
16.0.0 ≤
𝑥
< 16.4.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/frappe/hrms/releases/tag/v15.58.1
https://github.com/frappe/hrms/releases/tag/v16.4.1
https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx