---
id: "CVE-2026-121442"
kind: "vulnerability"
aliases: ["CVE-2026-121442"]
title: "Frappe HRMS: employees can view other employees' expense advance records"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe-hrms", "package", "self-hosted"]
not_affected_if: ["no-employee-logins", "version-15.61.0-or-later"]
published_at: "2026-11-03T15:17:36+00:00"
first_seen_at: "2026-11-03T15:22:00+00:00"
updated_at: "2026-11-03T15:23:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121442", "first_seen_at": "2026-11-03T15:22:00+00:00"}]
---

# Frappe HRMS: employees can view other employees' expense advance records

Frappe HRMS before 15.61.0 lacks proper authorization checks on the Expense Claim Advances API. An logged-in employee can query it and read expense advance records belonging to other employees.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version in the app's `apps.json` or with `bench version`, and compare it with `15.61.0`.
- Confirm whether the Expense Claim Advances API is reachable by ordinary employee accounts.

## Fix

- Frappe HRMS: upgrade to `15.61.0` or later.

## Timeline

- 2026-11-03T15:22:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121442

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-9f7p-ppw4-57p6
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-before-15.61.0-permission-bypass-via-expense-claim-advances-api

## From the sources

Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expense advance records belonging to other employees, exposing sensitive financial information.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_