Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121442Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in hrms from frappe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

Affected products (as reported)

Vendor	Product	Versions
frappe	hrms	0 – before 15.61.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-9f7p-ppw4-57p6) vendor-advisory
VulnCheck Advisory: Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API third-party-advisory