A flaw in the Frappe HRMS Leave Details API prevented proper authorization checks, allowing any authenticated employee to retrieve other employees’ leave records. This defect exposes sensitive personnel information and violates confidentiality requirements, as it can be exploited via a standard privilege‑bypass scenario. The flaw maps to CWE‑863, an improper authorization weakness.

The vulnerability affects the Frappe HRMS product. All installations running a version earlier than 16.5.0 are impacted; the fix was released in the 16.5.0 update.

With a CVSS score of 6.5 the issue is considered moderate. No EPSS score is available, and the vulnerability has not been listed in the CISA KEV catalog, indicating no documented exploitation at this time. The attack requires legitimate user credentials and exploits the application’s internal authorization logic. Once the system is updated to 16.5.0 or later, the risk is mitigated.