Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

Advisories

Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount

severity: medium
date: 10/11/2026
Affecting: hrms >= 0, < 16.11.0
CVE: CVE-2026-108732
CWE: CWE-862 Missing Authorization
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: https://hackmd.io/@haind03/frappe-hrms-fnf-payroll-amount-oracle
https://github.com/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_final_statement.py#L273-L327
https://github.com/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81f
hrms v16.11.0 Release Notes
https://github.com/frappe/hrms
Credit: HaiND from the Post and Telecommunication Institute of Technology
Description: Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo