Frappe HRMS CVE-2026-64862

Requires a valid authenticated session on the Frappe HRMS instance (any employee-level account suffices, PR:L) and that the deployment exposes the PWA (progressive web app) employee-data API endpoints that relied on the unprivileged frappe.get_all query. The attacker manipulates the employee identifier in those PWA API requests to retrieve another employee's records. Limiting factors that reduce real-world risk: exploitation is read-only (confidentiality impact only, no integrity/availability effect), it needs authentication so it is not exploitable by anonymous external attackers, and only instances running versions prior to 15.58.3 (15.x) or 16.4.3 (16.x) with the PWA in use are affected.

This is a broken-object-level-authorization (IDOR) flaw in Frappe HRMS PWA API endpoints, rated CVSS 6.5 (medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent: network-reachable (AV:N) and low-complexity (AC:L), but exploitation requires an authenticated account (PR:L), and impact is confidentiality-only (C:H, I:N, A:N) - matching the description, which states 'an authenticated user' reads other employees' records. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no signal of active or widespread exploitation; status is best described as no public exploit identified at time of analysis. The real-world risk is therefore an insider/horizontal-access threat rather than an external pre-auth breach: any user who can log into the HRMS (potentially every employee) could read colleagues' sensitive HR data. This is a legitimate privacy/compliance priority for organizations running many PWA users, but it is not an internet-facing unauthenticated emergency. The vendor fix is corroborated by source evidence (the commit swaps the permission-ignoring frappe.get_all for the permission-aware frappe.get_list), which strongly confirms the root cause is a missing authorization enforcement rather than an authentication bypass.

A low-privilege authenticated employee logged into the Frappe HRMS progressive web app calls the employee-data PWA API endpoints and substitutes another employee's identifier in the request. Because the endpoints used frappe.get_all (which bypasses user permission checks), the server returns records belonging to the other employee, exposing sensitive HR data. No public exploit code was identified in the provided data; exploitation is simple API parameter manipulation requiring a valid session.