Frappe HR allowed authenticated users to read files they should not have access to by calling a specific API endpoint. This improper access control flaw, identified as CWE‑284, can expose confidential documents or data stored in the system, thereby compromising confidentiality. The vulnerability requires that the attacker be logged into the system but does not require any additional privileges beyond normal user credentials.

The affected product is the open‑source HRMS known as Frappe HR (frappe:hrms). All releases before 15.58.2 and 16.4.2 suffer from this flaw; the advisory documents the patch in those two releases.

The CVSS score of 6.5 rates the issue as moderate, with an EPSS score unavailable and no listing in the CISA KEV catalog. Because the attack exploits an existing authenticated session, a user who can log in—possibly an employee or an compromised account—can download any accessible file through the vulnerable endpoint. No active exploit has been reported, but the path is straightforward once a user is authenticated.