CVE-2026-108733 in hrms
Summary
by MITRE • 10/11/2026
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/11/2026
The Frappe HRMS framework, encompassing versions prior to 16.11.0 as well as all releases within the 14.x and 15.x branches up through version 15.64.3, suffers from a critical missing authorization vulnerability located in the whitelisted expire_allocation method. This flaw represents a classic case of insecure direct object references where the application fails to verify that the authenticated user initiating the request has the necessary permissions or ownership rights over the specific resource being modified. The technical root cause lies in the server-side logic which accepts an identifier for a leave allocation record and proceeds to execute the expiration operation without cross-referencing this identifier against the current session's user context or role-based access control lists. Consequently, any authenticated user within the system can manipulate the state of another employee's data simply by supplying that employee's unique leave allocation ID in their request payload.
From an operational perspective, this vulnerability allows attackers who lack specific HR administrative roles to arbitrarily expire other employees' leave allocations. By sending a POST request with the target identifier, an attacker can zero out the allocated leaves for any given employee, effectively wiping their remaining leave balance. This action not only disrupts normal human resources operations but also poses significant risks regarding data integrity and user trust. Employees may find themselves unable to take entitled time off due to artificially depleted balances, leading to potential disputes and operational inefficiencies within organizations relying on the system for workforce management. The ease of exploitation means that even low-privilege users can cause substantial disruption without needing elevated privileges or complex attack vectors.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying authorization before performing actions on specific objects. Furthermore, the exploit technique maps to MITRE ATT&CK tactic T1078, Valid Accounts, as it leverages legitimate authentication credentials to perform unauthorized administrative-like functions that should be restricted to HR personnel or system administrators. The absence of server-side validation for object ownership is a common pitfall in web application development where developers assume that the presence of an authenticated session implies sufficient privilege for all subsequent actions within the module.
To mitigate this vulnerability, organizations must upgrade their Frappe HRMS instances to version 16.11.0 or later, which includes patches addressing these authorization checks. In environments where immediate upgrading is not feasible, temporary mitigations should include implementing strict role-based access controls at the application level to restrict access to leave management functions exclusively to users with designated HR roles. Additionally, deploying a Web Application Firewall can help detect and block anomalous POST requests that attempt to modify resources outside of expected user contexts. Regular security audits focusing on authorization logic in whitelisted methods are essential to prevent similar flaws from persisting in custom or extended modules within the Frappe ecosystem.