VULNERABILITY INTELLIGENCE

CVE-2026-40888

CVSS score6.5 MEDIUM
EPSS probability0.23%
CISA KEVNot currently listed
Published2026-04-21
Last modified2026-10-25
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Weakness classification

  • security-advisories@github.com: CWE-284

Primary references