Description (CNA)
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Frappe / HR | affected 16.0; affected 16.1; affected 16.2; affected 16.3; affected 16.4; affected 16.5; affected 16.6; affected 16.7; affected 16.8; affected 16.9; affected 16.10; affected 16.11; affected 16.12; affected 16.13; affected 16.14; affected 16.15.0 |
CWE
CWE-863, CWE-285
References
- https://vuldb.com/vuln/410876
- https://vuldb.com/vuln/410876/cti
- https://vuldb.com/cve/CVE-2026-101006
- https://vuldb.com/submit/919744
ADP enrichment
No English description supplied.
No references supplied.