CVE-2026-45081CWE-863

Frappe HR: Permission Bypass in HRMS Leave Details API

Medium · published May 27, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-05-27T17:18Z
EPSS history
Timeline
  • 27 MAY 17:18Z
    Frappe HR: Permission Bypass in HRMS Leave Details API
    cvelistv5