What is the CVSS score of CVE-2026-40889?

CVE-2026-40889 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40889?

Yes, a patch is available for CVE-2026-40889. Update the affected software to the latest version immediately.

Frappe HRMS CVE-2026-40889

EUVD-2026-24278 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 GitHub_M

Authentication Bypass Frappe Hrms

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint exploitable by any authenticated user (PR:L, AV:N, AC:L); impact is read-only file access with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:08 vuln.today

Analysis Generated

Jul 24, 2026 - 07:08 vuln.today

Patch released

Apr 27, 2026 - 19:39 nvd

Patch available

Apr 21, 2026 - 21:02 EUVD

EUVD ID Assigned

Apr 21, 2026 - 20:00 euvd

EUVD-2026-24278

CVE Published

Apr 21, 2026 - 19:32 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available.

AnalysisAI

Unauthorized file access in Frappe HRMS allows any authenticated user to retrieve files attached to documents they are not permitted to view by calling the attachment API endpoint without proper authorization enforcement. Affected versions span both the v15 branch (prior to 15.58.2) and v16 branch (prior to 16.4.2); patched releases are available from the vendor. No public exploit exists and EPSS is 0.03% (8th percentile), though the confidentiality impact is significant given that HR systems routinely store payroll records, employment contracts, and personal employee data.

Technical ContextAI

Frappe HRMS is an open-source human resources management system built on the Frappe Python/JavaScript framework, identified by CPE cpe:2.3:a:frappe:hrms:*:*:*:*:*:*:*:*. The root cause is CWE-284 (Improper Access Control): the file attachment API endpoint failed to validate whether the requesting authenticated user had permission to access documents referenced in the API call. The v15.58.2 release notes confirm the fix is in PR #4165, which corrects the 'attachment API to correctly list files linked to a document, including each file's name, download link, and privacy status' - indicating the endpoint previously returned file metadata and download links regardless of document-level permissions.

RemediationAI

Upgrade to Frappe HRMS version 15.58.2 (v15 branch) or 16.4.2 (v16 branch), available at https://github.com/frappe/hrms/releases/tag/v15.58.2 and https://github.com/frappe/hrms/releases/tag/v16.4.2 respectively. The vendor explicitly states no known workarounds are available. As a compensating control pending upgrade, organizations should audit access logs for the HRMS attachment API endpoint for anomalous cross-document queries, restrict HRMS access to trusted internal networks or VPN only to reduce the attack surface, and ensure the principle of least privilege is enforced on user accounts - noting that any authenticated account is sufficient to exploit the unpatched vulnerability.