Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-101006: Frappe HR allows unauthorized access to attendance data
CVE-2026-101006 · published 21 days ago
Summary
The Frappe HR system (versions up to 16.15.0) does not correctly check who is requesting attendance, expense, or shift information, so a user could see data they shouldn’t. This can be triggered from outside the network. The vendor has released a fix, so applying the latest update resolves the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frappe | hr | 16.0 |
Original advisory text
Frappe HR Permission Validation __init__.py get_attendance_requests authorization
A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function get_expense_claims/get_shift_requests/get_attendance_requests of the file hrms/api/__init__.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote exploitation of the attack is possible. The vendor replied: "This issue has already been reported by another individual, and based on that, we have fixed it."
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-285Improper Authorization
CWE-863Incorrect Authorization
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta