Live › vulnerability › CVE-2026-121442
Frappe HRMS before 15.61.0 lacks proper authorization checks on the Expense Claim Advances API. An logged-in employee can query it and read expense advance records belonging to other employees.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:22 UTC. All times on this page are UTC.
Companies that run Frappe HRMS versions before 15.61.0 with employee self-service accounts. Exposure depends on whether employees can reach the Expense Claim Advances API. Instances without employee logins or running 15.61.0 or later are not affected.
No product ranges from the sources yet.
apps.json or with bench version, and compare it with 15.61.0.15.61.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.
This page as .md · .json · in your agent: get_signal("CVE-2026-121442")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.