Frappe HR CVE-2026-108733

Requires a valid authenticated session on the Frappe HR instance - any ordinary logged-in user/employee, explicitly WITHOUT HR roles, is sufficient (PR:L). The attacker must know or enumerate the target's Leave Allocation document name, then issue a POST request to the whitelisted expire_allocation method, which is exposed by default and performs no permission check (CWE-862). Limiting factors: exploitation needs an authenticated account (not reachable by fully anonymous attackers), no user interaction from the victim, and impact is confined to integrity of leave-balance data (no confidentiality or availability impact); affects all 14.x and 15.x releases through 15.64.3 and versions before 16.11.0 in default configuration.

This is a medium-severity, insider-oriented data-integrity flaw rather than a mass-exploitation emergency. The vendor-supplied CVSS 4.0 vector (5.3, AV:N/AC:L/AT:N/PR:L/UI:N) confirms network reachability and low complexity but requires an authenticated low-privilege account (PR:L), and the impact is limited to integrity of leave data (VI:L) with no confidentiality (VC:N) or availability (VA:N) impact - consistent with CWE-862 Missing Authorization. No EPSS score and no SSVC decision data are present in the input, so exploitation probability and the automatable/technical-impact dimensions cannot be quantified; this gap should be noted when prioritizing. The CVE is NOT in CISA KEV and there is no explicit POC flag, though a detailed public technical writeup (HackMD) and a VulnCheck advisory exist, lowering the effort to reproduce. Netting the signals: the PR:L requirement means the realistic threat actor is a malicious or compromised internal user, and the blast radius is limited to overwriting another employee's leave balance - meaningful HR-data tampering, but not remote code execution or data theft. Treat as a prompt patch item (fix is available in 16.11.0) rather than a drop-everything priority; the absence of EPSS/KEV supports targeted/opportunistic insider abuse over widespread automated exploitation.

A disgruntled employee holding an ordinary HRMS login (no HR role) sends a crafted POST request to the whitelisted expire_allocation method, naming a coworker's Leave Allocation document. Because the method omits an authorization check, the server expires that allocation and zeroes the victim's remaining leave balance. A public technical writeup on HackMD describes the flaw in detail, lowering the barrier to reproduction, though no formal exploit-code flag is provided in the input.