Medium severity · published May 27, 2026
CVE-2026-45081
Frappe HR: Permission Bypass in HRMS Leave Details API
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HR
hrms · frappe
< 16.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45081
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45081
github.com
https://github.com/frappe/hrms/security/advisories/GHSA-9jpf-5vrm-hpcj
More from hrms
7.7
CVE-2026-111389
Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation
7.1
CVE-2026-54524
Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report
6.5
CVE-2026-64862
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
6.5
CVE-2026-55796
Frappe HR: SQL Injection in HRMS Salary Payments via ECS Report
6.5
CVE-2026-41320
Frappe HR has possibility of SQL Injection due to improper field sanitization