CVE-2026-64862 in HRMS
Summary
by MITRE • 10/17/2026
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified within Frappe HR, an open-source human resources management solution, represents a critical failure in server-side access control mechanisms specifically affecting the Progressive Web App API endpoints. This flaw allows authenticated users to bypass intended authorization checks when requesting employee-specific data through these application programming interfaces. The core technical deficiency lies in the inconsistent validation of user identity against the requested resource identifier. When an authenticated session is established, the system fails to rigorously verify that the current user possesses explicit permission to access the specific employee records being queried via the PWA API endpoints. This lack of consistent authorization logic creates a direct pathway for unauthorized data retrieval, as the server processes requests based on input parameters rather than enforcing strict ownership or role-based constraints relative to the authenticated session context.
From an operational perspective, this vulnerability enables horizontal privilege escalation where one employee can access sensitive personal information belonging to their colleagues without any additional authentication steps beyond possessing valid credentials. The impact is severe given the nature of HR data, which typically includes personally identifiable information such as social security numbers, bank account details for payroll processing, home addresses, and performance reviews. Unauthorized access to this data violates fundamental principles of confidentiality and integrity within human resources operations. It exposes organizations to significant regulatory compliance risks under frameworks such as GDPR or HIPAA if applicable, and can lead to reputational damage, legal liability, and potential identity theft scenarios for affected employees. The use of PWA endpoints exacerbates the risk because these interfaces are often designed for mobile accessibility and may be perceived by developers as less critical than traditional web dashboard routes, leading to laxer security implementations during development cycles prior to version 15.58.3 and 16.4.3.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting a failure in enforcing proper authorization checks for specific user roles or data ownership. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Collection via Unsecured API and potentially Account Manipulation if the accessed data is used for further social engineering attacks against other staff members. The exploitation vector relies on simple HTTP requests where an attacker modifies parameters such as employee IDs or user identifiers in the request payload to target records belonging to different individuals within the same organization. Since the authentication layer successfully validates the session but fails at the authorization layer, standard web application firewalls may not detect this activity unless they are specifically configured to monitor for anomalous data access patterns across multiple distinct entities by a single authenticated source.
Mitigation strategies must prioritize immediate patching of the Frappe HR instance to version 15.58.3 or later where these authorization checks have been corrected and consistently enforced across all PWA API endpoints. For organizations unable to upgrade immediately, implementing strict input validation on server-side controllers is essential to ensure that any request for employee data includes a verification step confirming that the requesting user ID matches the owner of the requested record or possesses elevated administrative privileges. Additionally, deploying Web Application Firewalls with rulesets tuned to detect bulk scraping or unusual access patterns by single users can provide an additional layer of defense. Regular security audits focusing on API endpoint authorization logic are recommended to prevent similar flaws in other modules of the HRMS platform, ensuring that all data retrieval operations adhere to the principle of least privilege and strict identity verification before serving sensitive human resources information.