CVE-2026-108732 json
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
published 29d ago modified 24d ago also EUVD-2026-96898
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
Patch / fix
- frappe hrms 16.11.0
Is CVE-2026-108732 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 27d ago
Exploit prediction
0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- hackmd.io https://hackmd.io/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracle referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- frappe hrms
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/frappe/hrms/commit/6ab7a50347367413b78ad5bd5d9e4b8c6653c81f
patch
-
hackmd.io
/@haind03/cve-2026-108732-frappe-hrms-fnf-payroll-amount-oracle
exploit
-
hackmd.io
/@haind03/frappe-hrms-fnf-payroll-amount-oracle
third-party-advisory
-
github.com
/frappe/hrms/blob/0a54d2c7b8b6043e2705b6f557b6ed65260670dd/hrms/hr/doctype/full_and_final_statement/full_and_f
technical-description
-
github.com
/frappe/hrms/releases/tag/v16.11.0
release-notes
-
github.com
/frappe/hrms
product
-
vulncheck.com
/advisories/frappe-hr-hrms-before-16.11.0-missing-authorization-via-get-account-and-amount
third-party-advisory
Sources
- CVE List CVE-2026-108732
- NVD CVE-2026-108732
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.