Frappe HR CVE-2026-108732

Requires only a valid authenticated session on the Frappe HRMS instance (PR:L) - crucially, the attacker does NOT need any HR role or elevated privilege. The specific trigger is the whitelisted get_account_and_amount method exposed over /api/method, which lacked a frappe.has_permission check; exploitation depends on supplying enumerable Salary Slip or full-and-final/claim document names, which are sequential/guessable, enabling systematic harvesting. No non-default configuration and no user interaction are needed - the endpoint is whitelisted by default on affected 14.x, 15.x (through 15.64.3), and pre-16.11.0 builds. Limiting factors: the attacker must first obtain any authenticated account, disclosure is confined to payroll/loan/advance/claim amounts (no write or system impact), and upgrading to 16.11.0 (or applying commit 6ab7a50) adds the missing read-permission check.

This is a medium-severity broken-access-control / IDOR issue (CWE-862), not a critical one, and the signals are internally consistent. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) scores 5.3: network-reachable and low-complexity, but it requires an authenticated session (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect. The real-world risk is therefore an authenticated/insider exposure: any logged-in Frappe HRMS user - explicitly including those WITHOUT HR roles - can read other employees' net pay and loan/advance/claim balances by calling the whitelisted get_account_and_amount method with enumerable document names. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified, and the CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation - status is 'no public exploit identified at time of analysis.' However, a detailed public technical writeup (hackmd) documents the enumeration/oracle method, which materially lowers the barrier to exploitation even though no packaged exploit code is referenced. Net: a genuine privacy/payroll-confidentiality priority for organizations with many low-trust HRMS accounts, but not an internet-facing unauthenticated emergency. Note the input 'Authentication Bypass' tag is inaccurate - the flaw is an authorization (not authentication) failure and the attacker is already authenticated.

A disgruntled or curious employee holding a standard Frappe HRMS login but no HR role scripts requests to /api/method/...get_account_and_amount, iterating over predictable Salary Slip and claim document names to harvest colleagues' net pay and loan, advance, and claim balances. A public technical writeup on hackmd documents this oracle-style enumeration technique, so the method is known even though no weaponized exploit tool is referenced. Because the vector is network/low-complexity but requires a valid authenticated account (PR:L), this is realistically an insider or compromised-credential scenario rather than anonymous remote mass exploitation.