The vulnerability arises from missing authorization checks on specific Progressive Web App (PWA) API endpoints used to retrieve employee data. An authenticated user can request records associated with another employee, enabling privileged access to sensitive HR information. The flaw is based on improper authorization and does not involve privilege escalation beyond the current user credentials.

This issue affects the Frappe HRMS open‑source product prior to version 15.58.3 and 16.4.3. All deployments that rely on the affected PWA endpoints and have not applied the published updates are susceptible.

The CVSS score of 6.5 indicates a moderate severity. No EPSS score is available, but the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation reports. An attacker must first authenticate to the system and then invoke the vulnerable PWA API endpoints, which are accessible over the network. Successful exploitation grants access to confidential employee data that belongs to other users.