Frappe HR allows an authenticated user with a default role to call a specific API endpoint that returns information they are not permitted to see. The flaw is an example of CWE‑284 – improper access control. This results in confidential HR data being disclosed to users who should not have access, potentially exposing personal employee information.

Versions of Frappe HR released before 15.58.1 and 16.4.1 are affected. The vulnerability is present in the frappe:hrms product for all older releases; applying the patch found in those releases resolves the issue.

The CVSS score of 6.5 indicates a moderate impact. The exploit requires an authenticated account but no special privileges beyond the default role, making it likely that a legitimate user could locate the vulnerable endpoint. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the lack of a public exploit does not reduce the risk of data exfiltration in a production environment.