CVE-2026-108732 in HRMS
Summary
by MITRE • 10/11/2026
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The vulnerability identified in Frappe HR (hrms) versions prior to 16.11.0 represents a critical failure in access control mechanisms within the application's backend logic. This flaw specifically affects all releases of the 14.x and 15.x branches up through version 15.64.3, indicating that the issue has persisted across multiple major updates without adequate remediation. The core technical deficiency lies in the get_account_and_amount method, which is exposed as a whitelisted API endpoint accessible via standard HTTP requests to /api/method. While Frappe frameworks typically rely on strict role-based access control to secure sensitive data operations, this particular function fails to enforce sufficient authorization checks before processing user input or returning results. Consequently, any authenticated user who possesses valid credentials for the application can invoke this method regardless of their assigned organizational roles or permissions within the HR module.
From a technical perspective, the vulnerability exploits the lack of server-side validation regarding the caller's privileges relative to the data being accessed. The get_account_and_amount function is designed to retrieve financial details such as payroll amounts, loan balances, advance payments, and claim statuses for specific employees identified by their Salary Slip or claim document names. Because these identifiers are enumerable, an attacker can systematically iterate through known or guessed employee IDs and document keys to harvest sensitive compensation data from the database. The absence of a check ensuring that the requesting user has HR administrator rights or at least visibility into the target employee's records allows for unauthorized lateral movement within the dataset. This bypasses the intended security boundary where only authorized personnel should be able to view detailed financial information about other staff members, effectively turning an authenticated session into a powerful tool for data exfiltration.
The operational impact of this vulnerability is severe due to the sensitivity of the exposed data class. Payroll amounts constitute personally identifiable information and confidential corporate financial data that are protected under various privacy regulations such as GDPR in Europe or CCPA in California. The disclosure of net pay, loan balances, advance payments, and claim statuses can lead to significant reputational damage for the organization hosting the HRMS instance. Beyond regulatory fines, this exposure facilitates social engineering attacks where malicious actors use real financial data to craft convincing phishing campaigns against employees. It also creates an environment ripe for internal fraud or extortion, as disgruntled employees or external attackers with compromised accounts could leverage this knowledge for blackmail or competitive intelligence gathering. The ability to enumerate these records means the scope of impact is not limited to a single individual but extends across the entire workforce whose data resides in the system.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-285 Improper Authorization and CWE-601 URL Redirection to Untrusted Site (if combined with other flaws) or more accurately CWE-862 Missing Authorization. It also maps directly to MITRE ATT&CK technique T1078 Valid Accounts, as the exploitation requires initial authentication but then abuses those credentials to access resources outside their intended scope. The enumerable nature of the attack vector further correlates with data discovery techniques often seen in post-exploitation phases where attackers map out available assets and sensitive information stores within a compromised environment.
To mitigate this risk, organizations running affected versions must immediately upgrade Frappe HR to version 16.11.0 or later, which includes patches for the authorization logic in the get_account_and_amount method. For environments that cannot be upgraded instantly due to compatibility constraints with other modules, temporary mitigations should include restricting access to the /api/method endpoint via web application firewall rules if possible, although this is less effective than a code-level fix since the API itself must remain open for legitimate HR operations. Additionally, implementing strict rate limiting on authentication and API endpoints can help mitigate automated enumeration attacks by slowing down bulk requests designed to harvest employee data. Security teams should also audit existing user roles within the Frappe system to ensure that no unnecessary broad permissions are granted to users who do not require access to sensitive financial modules, adhering to the principle of least privilege. Regular penetration testing focused on broken object level authorization flaws is recommended to identify similar gaps in other whitelisted methods before they can be exploited by adversaries.