CVE-2026-40889

Published: Apr 21, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available.

Affected (2)

Products: Frappe: Frappe Hr

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Frappe Frappe Hr	Before 15.58.2
Frappe Frappe Hr	From 16.0.0 to 16.4.2

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://github.com/frappe/hrms/releases/tag/v15.58.2

Source: security-advisories@github.com

Release Notes

https://github.com/frappe/hrms/releases/tag/v16.4.2

Source: security-advisories@github.com

Release Notes

https://github.com/frappe/hrms/security/advisories/GHSA-6cg5-4q6m-vrgm

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.