CVE-2026-45081

Vulnerability

An improper authorization vulnerability exists in Frappe HRMS (open-source HR solution) prior to version 16.5.0. The leave details API endpoint fails to verify that the requesting employee has permission to view the specified employee's leave records. This allows any authenticated employee to access leave details of other employees without proper authorization.

Exploitation

An attacker must be an authenticated employee of the organization using Frappe HRMS. No special privileges or administrative access is required. The attacker can directly call the leave details API endpoint with a different employee's identifier to retrieve their leave information. No user interaction from the victim is needed.

Impact

Successful exploitation results in unauthorized disclosure of other employees' leave details, including leave types, dates, and statuses. This violates confidentiality of personal data and can be used for social engineering or internal reconnaissance. The attack does not allow modification or deletion of data, nor does it affect availability.

Mitigation

The vulnerability is fixed in Frappe HRMS version 16.5.0, released on March 13, 2026, according to the advisory [1]. All users should upgrade to 16.5.0 or later. No workarounds are available. The vulnerability is not listed in CISA KEV.