Frappe HRMS EUVD-2026-115864

Exploitation requires an authenticated Frappe HRMS account (PR:L) with access to the Expense Claim Advances API; the attacker queries that specific API endpoint and, because of the missing authorization check, receives expense advance records owned by other employees. This affects Frappe HRMS versions before 15.61.0. The primary limiting factor is the authentication requirement - the attacker must already be a valid employee user (or possess valid employee credentials), so this is not remotely exploitable by an anonymous attacker. No special non-default configuration or user interaction is required (UI:N); impact is confined to read access to other employees' expense advance financial data (no integrity or availability impact).

This is a moderate-severity information-disclosure issue, not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 score indicate a network-reachable flaw that is low-complexity to trigger but requires authentication (PR:L), and whose impact is limited to confidentiality (VC:L with VI:N/VA:N) - an authenticated employee reading other employees' expense advance records via the Expense Claim Advances API. No EPSS score was supplied, the CVE is not in CISA KEV, and no public exploit was provided in the input, so there is no_public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month', which is consistent with a confirmed-but-low-urgency authorization flaw: real and worth patching, but not an act_now/emergency priority. The key limiting factor is that exploitation requires a valid authenticated HRMS employee account, so the realistic threat is an insider or a holder of compromised employee credentials rather than an anonymous internet attacker. Missing signals: no EPSS and no independent corroboration of exploitation - absence here is expected for a newly reported low-urgency bug and is not itself a red flag.

An authenticated employee (or an attacker using stolen employee credentials) logs into a Frappe HRMS instance and issues queries to the Expense Claim Advances API. Because authorization checks are improperly enforced, the API returns expense advance records belonging to other employees, exposing their sensitive financial details. No public exploit code was identified in the sources, but the attack is low-complexity once authenticated.