Frappe HR CVE-2026-101006

Requires a valid authenticated Frappe HR session at low privilege (PR:L) - any ordinary employee/user account with API access suffices; no admin rights or user interaction needed. The attacker invokes the get_expense_claims, get_shift_requests, or get_attendance_requests API endpoints and supplies a victim's employee identifier in the employee argument, which the Permission Validation logic fails to authorize. Limiting factors: the attacker must already hold credentials on the target instance, impact is read-only disclosure of HR data (expense claims, shift requests, attendance) with no write/privilege gain, and the target must run Frappe HR at or below version 16.15.0.

This is a genuine but low-severity issue, correctly rated MEDIUM. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N/VC:L, all other impacts N) describes a remotely reachable, low-complexity authorization flaw exploitable by any authenticated low-privilege user, with only limited confidentiality impact and no integrity or availability impact - consistent with the CWE-863 (incorrect authorization / IDOR) classification. No EPSS score is provided and the CVE is not in CISA KEV, so there is no evidence of widespread or active exploitation; the E:P in the vector indicates proof-of-concept maturity rather than confirmed in-the-wild use. The signals are mutually consistent: a real, easily-triggered data-exposure bug but low blast radius (read-only leakage of HR records, no privilege gain or takeover). Note two data caveats: the vendor states the issue was reported by a third party and already fixed, but NO fixed version is supplied in the input, so remediation cannot be pinned to a release; and the 'Authentication Bypass' tag is inaccurate - this is an authorization (access-control) flaw, not an authentication bypass, since the attacker is already authenticated.

An authenticated low-privileged Frappe HR user (e.g. an ordinary employee) calls the get_expense_claims, get_shift_requests, or get_attendance_requests API and substitutes another worker's identifier in the employee argument. Because the endpoint fails to verify the caller is authorized for that employee, it returns the targeted employee's expense claims, shift requests, or attendance records. Exploitation is straightforward given proof-of-concept maturity (E:P) and requires only a valid low-privilege session.