PT-2026-136199
CVE-2026-121442
·
Published
2026-11-03
·
Updated
2026-11-03
Description by
CVSS 4.0
5.3
MediumMetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Frappe HRMS versions prior to 15.61.0
Description
Improper authorization checks allow authenticated employees to bypass permissions and view expense advance details of other employees. This is achieved by querying the Expense Claim Advances API, which exposes sensitive financial information.
Recommendations
Update to version 15.61.0 or later.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾