Medium severity6.5NVD Advisory· Published Apr 21, 2026· Updated Apr 27, 2026
CVE-2026-40888
CVE-2026-40888
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfxnvdVendor Advisory
- github.com/frappe/hrms/releases/tag/v15.58.1nvdRelease Notes
- github.com/frappe/hrms/releases/tag/v16.4.1nvdRelease Notes
News mentions
0No linked articles in our index yet.