Description
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized modification of employee leave balances
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is caused by a missing authorization check in the expire_allocation method of Frappe HR. An authenticated user can issue a POST request that targets any employee’s leave allocation record and sets the allocated leaves to zero, effectively erasing that employee’s remaining leave balance. This flaw permits an attacker to tamper with employee leave data, undermining the integrity of personnel records and potentially violating compliance requirements.

Affected Systems

All Frappe HR (hrms) releases before 16.11.0—including every 14.x and 15.x version up to 15.64.3—contain the bug. The affected code is in the hrms module’s leave_ledger_entry.py file. The issue was fixed in release v16.11.0.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium level of risk, and the vulnerability is not listed in the CISA KEV catalog. EPSS information is not available, so exploitation probability cannot be quantified. Attackers only need to be authenticated and do not require HR roles, giving a broad attack surface and a straightforward path to abuse the flaw.

Generated by OpenCVE AI on October 11, 2026 at 13:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Frappe HR to version 16.11.0 or later where the authorization check has been restored.
  • Restrict the expire_allocation API so that only users with HR roles can invoke it, and review role assignments to ensure others cannot access leave allocation functions.
  • Audit recent leave allocation records for unauthorized expirations and restore correct balances as needed.

Generated by OpenCVE AI on October 11, 2026 at 13:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Title Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
First Time appeared Frappe
Frappe frappe Hr
Weaknesses CWE-862
CPEs cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*
Vendors & Products Frappe
Frappe frappe Hr
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Frappe Frappe Hr
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-11T12:19:40.218Z

Reserved: 2026-10-11T01:52:48.083Z

Link: CVE-2026-108733

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-11T13:17:17.490

Modified: 2026-10-11T13:17:17.490

Link: CVE-2026-108733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T14:15:17Z

Weaknesses