Read the docs
TI-2026-29544 Aliases CVE-2026-40888

Frappe HR vulnerable to Improper Access Control

Priority LOW 28CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-284.

Summary

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00232 14th percentileScored 2026-11-07
Fix Fixed hrms (frappe): 15.58.1, 16.4.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frappehrmsbefore 15.58.1; before 16.4.115.58.1, 16.4.1Patch availableCNA
  • hrms Vendorfrappe Affected before 15.58.1; before 16.4.1 Fixed in 15.58.1, 16.4.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:*before 15.58.1; 16.0.0 to before 16.4.1Vulnerablefrappe
  • cpe:2.3:a:frappe:frappe_hr:*:*:*:*:*:*:*:* Versions before 15.58.1; 16.0.0 to before 16.4.1 Vulnerable ·frappe

Remediation

  • Fix · CNA hrms (frappe) Fixed in 15.58.1, 16.4.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40888

References

Advisory 1

Other 2

  • TI-2026-29921 Frappe HR has possibility of SQL Injection due to improper field sanitization CVSS 3.1MEDIUM 6.5
  • TI-2026-29545 Frappe HR has Improper Access Control on Files CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences