Invia #919744: Frappe Technologies Pvt. Ltd. Frappe HR v16.15.0 Authorization Bypass Through User-Controlled Key (CWE-639)

Frappe HR v16.15.0 contains a shared IDOR flaw across get_expense_claims, get_shift_requests and get_attendance_requests APIs, allowing authenticated users to read other employees' financial and attendance records via uncontrolled employee parameter.
Vulnerability Overview
A cross-user authorization bypass (CWE-639) exists in multiple APIs sharing the unsafe get_filters helper function in hrms/api/__init__.py v16.15.0.
Affected functions: get_expense_claims (516-557), get_shift_requests (179-215), get_attendance_requests (218-253). The shared get_filters function directly uses attacker-supplied employee ID without permission validation when for_approval=false, enabling horizontal privilege escalation.

Vulnerable Logic
get_expense_claims passes user-controlled employee parameter to get_filters; line 281 sets filters.employee = employee with no frappe.has_permission("Employee", "read", employee) verification. The query returns full records of the target employee’s expense claims, shift requests and attendance logs.

Attack Vector
Authenticated remote HTTP POST to /api/method/hrms.api.get_expense_claims with JSON body:
{"employee": "EMP-TARGET-001"}
Valid session cookie is the only requirement. The same exploitation pattern applies to get_shift_requests and get_attendance_requests endpoints.

Impact
Attackers can retrieve third-party employees’ expense amounts, approval status, shift schedules and attendance history, leaking sensitive financial and work-time data across the organization.

Root Cause & Remediation
Root cause: The get_filters helper does not validate whether the requesting user has read access to the target employee record before applying user-controlled filter values.
Reference: get_expense_claim_summary safely restricts data to current authenticated employee via get_current_employee().

CVSS v3.1 Score: 6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Discoverer: [Ordinaryzyx]

• Fonte: ⚠️ https://github.com/frappe/hrms
• Utente: zyx122126 (UID 100375)
• Sottomissione: 09/08/2026 13:44 (2 mesi fa)
• Moderazione: 27/09/2026 12:58 (2 months later)
• Stato: Accettato
• Voce VulDB: 410876 [Frappe HR fino a 16.15.0 Permission Validation hrms/api/__init__.py employee escalationi di privilegi]
• Punti: 19