Frappe HRMS CVE-2026-40888

Authentication is required: the CVSS vector PR:L confirms that a low-privileged account is sufficient, and the description explicitly states a 'default role' qualifies - no elevated or specially assigned permissions are needed beyond a standard user account. The vulnerability is scoped to the Roster shift assignment module's employee-detail loading endpoint; users or deployments that do not use or expose the Roster feature have a reduced but not eliminated attack surface. Exploitation is not automatable per SSVC, meaning mass-enumeration or worm-like propagation is not expected. Limiting factors: valid credentials must be obtained (social engineering, credential stuffing, or insider); access to the affected Roster API endpoint must be network-reachable; and the impact is read-only - no data modification or availability disruption is possible through this vector.

The CVSS 3.0 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects genuine medium severity: network-reachable, low complexity, but gated behind valid authentication with at least a default role, limiting the exposed population to insiders or credential-holding attackers. The High confidentiality rating is appropriate given that private HR employee fields are exposed. However, EPSS at 0.03% (8th percentile) indicates near-zero observed exploitation activity in the wild, and CISA SSVC concurs - exploitation status is 'none' and the vulnerability is rated not automatable with only partial technical impact. The combination of low EPSS, no KEV listing, no public POC, and mandatory authentication meaningfully reduces real-world risk below what the CVSS C:H score alone would suggest. This is a genuine information-disclosure issue warranting patching, but it is not an emergency priority for organizations without imminent insider threat concerns.

An attacker who holds a valid Frappe HRMS account with only the default role navigates to the Roster shift assignment feature and directly invokes the underlying employee-detail API endpoint, receiving a response containing private HR fields - such as personal contact information or compensation-related attributes - for employees across the organization. No public proof-of-concept code has been identified, and exploitation requires active session credentials, limiting the realistic attacker to a malicious insider or a threat actor who has already compromised a low-privilege account.