{"id":"CVE-2026-121442","kind":"vulnerability","aliases":["CVE-2026-121442"],"related":[],"title":"Frappe HRMS: employees can view other employees' expense advance records","description":"Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.","summary":"Frappe HRMS before 15.61.0 lacks proper authorization checks on the Expense Claim Advances API. An logged-in employee can query it and read expense advance records belonging to other employees.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe-hrms","package","self-hosted"],"not_affected_if":["no-employee-logins","version-15.61.0-or-later"],"how_to_check":"- Check the installed HRMS version in the app's `apps.json` or with `bench version`, and compare it with `15.61.0`.\n- Confirm whether the Expense Claim Advances API is reachable by ordinary employee accounts.","fix":"- Frappe HRMS: upgrade to `15.61.0` or later.","status":"open","published_at":"2026-11-03T15:17:36+00:00","first_seen_at":"2026-11-03T15:22:00+00:00","triaged_at":"2026-11-03T15:23:29+00:00","updated_at":"2026-11-03T15:23:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:23:29Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS: upgrade to `15.61.0` or later.","reach":"network","title":"Frappe HRMS: employees can view other employees' expense advance records","impact":"low","summary":"Frappe HRMS before 15.61.0 lacks proper authorization checks on the Expense Claim Advances API. An logged-in employee can query it and read expense advance records belonging to other employees.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","self-hosted","erpnext"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated employees read other employees' expense advance financial records.","analyst_note":"","how_to_check":"- Check the installed HRMS version in the app's `apps.json` or with `bench version`, and compare it with `15.61.0`.\n- Confirm whether the Expense Claim Advances API is reachable by ordinary employee accounts.","plain_action":"","needs_analyst":false,"not_affected_if":["version-15.61.0-or-later","no-employee-logins"],"who_is_affected":"Companies that run Frappe HRMS versions before 15.61.0 with employee self-service accounts. Exposure depends on whether employees can reach the Expense Claim Advances API. Instances without employee logins or running 15.61.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000673,"input_tokens":4173,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121442':13A,16A '-2026':12A,15A '15.61.0':28B,59C 'advanc':9A,37B,50B,74C,87C,92C 'allow':66C 'api':38B,88C 'attack':81C 'authent':67C 'author':31B,79C 'belong':52B,94C 'bypass':63C 'check':32B,80C 'claim':36B,86C 'contain':60C 'cve':11A,14A 'detail':75C 'due':76C 'employe':3A,7A,43B,55B,68C,72C,97C 'erpnext':17B 'expens':8A,35B,49B,73C,85C,91C 'expos':98C 'financi':100C 'frapp':1A,19B,25B,56C 'frappe-hrm':18B 'host':24B 'hrms':2A,20B,26B,57C 'improp':78C 'inform':101C 'lack':29B 'log':41B 'logged-in':40B 'packag':21B 'permiss':62C 'proper':30B 'queri':45B,83C 'read':48B 'record':10A,51B,93C 'retriev':90C 'self':23B 'self-host':22B 'sensit':99C 'view':5A,70C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Companies that run Frappe HRMS versions before 15.61.0 with employee self-service accounts. Exposure depends on whether employees can reach the Expense Claim Advances API. Instances without employee logins or running 15.61.0 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappehrms","medium","package","selfhosted"],"first_public_at":"2026-10-19T07:02:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121442","severity":null,"published_at":"2026-11-03T15:17:36+00:00","modified_at":"2026-11-03T15:17:36+00:00","first_seen_at":"2026-11-03T15:22:00+00:00","fetched_at":"2026-11-03T15:22:00+00:00","note":null}],"documents":[{"id":58411,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T07:02:38+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58412,"url":"https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}