CVE-2026-40888CWE-284

Frappe HR vulnerable to Improper Access Control

Medium · published April 21, 2026

CVSS v3.0
6.5
EPSS
0%
Percentile
33.5
In the wild
Unconfirmed
What it is

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00404 · 33.5th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-04-21T19:28Z
EPSS history
Timeline
  • 21 APR 19:28Z
    Frappe HR vulnerable to Improper Access Control
    cvelistv5