What is the CVSS score of CVE-2026-40888?

CVE-2026-40888 has a CVSS 3.0 base score of 6.5 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40888?

Yes, a patch is available for CVE-2026-40888. Update the affected software to the latest version immediately.

Frappe HRMS CVE-2026-40888

EUVD-2026-24276 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 GitHub_M

Authentication Bypass Frappe Hrms

6.5

CVSS 3.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible API requires only a default authenticated session (PR:L); read-only private field exposure justifies C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:08 vuln.today

Analysis Generated

Jul 24, 2026 - 07:08 vuln.today

Patch released

Apr 27, 2026 - 19:39 nvd

Patch available

Apr 21, 2026 - 21:02 EUVD

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24276

CVE Published

Apr 21, 2026 - 19:28 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

AnalysisAI

Unauthorized employee data disclosure in Frappe HRMS allows any authenticated user holding only a default role to retrieve private employee fields via an insufficiently access-controlled API endpoint in the Roster shift assignment module. Affected versions span the v15 branch prior to 15.58.1 and the v16 branch prior to 16.4.1. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile), and CISA SSVC rates exploitation as none with partial technical impact.

Technical ContextAI

Frappe HRMS is an open-source human resources management solution built on the Frappe framework (CPE: cpe:2.3:a:frappe:hrms:*:*:*:*:*:*:*:*). The root cause is CWE-284 (Improper Access Control): the Roster shift assignment view loaded employee detail records using an insecure client-facing API that did not enforce field-level access restrictions, returning private attributes beyond what the requesting user's role authorizes. The fix - confirmed in the v15.58.1 and v16.4.1 release notes - replaces that call with a secure client API that restricts the response to Employee Name, Company, and Department only. The vulnerability is confined to the confidentiality axis; no write operations or service disruption are possible through this path.

RemediationAI

Upgrade Frappe HRMS to version 15.58.1 (v15 branch) or 16.4.1 (v16 branch), both released with a targeted fix that switches the Roster employee-detail loading call to a secure client API. These patched releases are available at https://github.com/frappe/hrms/releases/tag/v15.58.1 and https://github.com/frappe/hrms/releases/tag/v16.4.1. The GitHub security advisory (https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx) explicitly states no known workarounds are available, so patching is the sole mitigation. As an interim measure while scheduling the upgrade, administrators may consider restricting access to the Roster module for roles that do not operationally require it, accepting the trade-off of reduced scheduling functionality for lower-privilege users.