CVE-2026-101006

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.15.0

Description An incorrect authorization issue exists within the Permission Validation component. The flaw allows remote exploitation by manipulating the employee argument in the get expense claims(), get shift requests(), and get attendance requests() functions located in the hrms/api/ init .py file.

Recommendations Update Frappe HR to version 16.15.0 or later. As a temporary mitigation, restrict access to the get expense claims(), get shift requests(), and get attendance requests() functions.