CVE-2026-40888

Published: Apr 21, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Affected (2)

Products: Frappe: Frappe Hr

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Frappe Frappe Hr	Before 15.58.1
Frappe Frappe Hr	From 16.0.0 to 16.4.1

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://github.com/frappe/hrms/releases/tag/v15.58.1

Source: security-advisories@github.com

Release Notes

https://github.com/frappe/hrms/releases/tag/v16.4.1

Source: security-advisories@github.com

Release Notes

https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.