Frappe HR (hrms) versions before 16.11.0 contain a missing authorization flaw in the get_account_and_amount method. The flaw allows any authenticated user to invoke the method via the public /api/method endpoint, providing document names such as Salary Slip or claim documents. The method then returns sensitive payroll information, including net pay, loan, advance, and claim balances, which should be restricted to authorized HR personnel. This leads to the exposure of confidential employee compensation data.

The vulnerability affects all Frappe HR (hrms) releases from 14.x through 15.64.3 and all versions prior to 16.11.0. Users running these versions on the web or API layer are at risk.

The CVSS score of 5.3 indicates moderate severity. Because the attack requires only an authenticated session and can be performed over a standard API call, the likelihood of exploitation is sufficiently high for organizations handling sensitive payroll information. EPSS data is not available, but the lack of the KEV flag means this issue has not yet been documented as a widely exploited vulnerability. However, the nature of the data exposed warrants immediate attention from security teams.