Live › vulnerability › CVE-2026-64862
Go to dashboardFrappe HRMS PWA API endpoints for employee data do not consistently check that the requester owns the record. An authenticated user can request HR records belonging to other employees.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Frappe HRMS app on a version before 15.58.3 or 16.4.3 with the PWA employee API reachable by logged-in users. Exposure depends on the authenticated users who can reach the endpoints; sites without the HRMS app or already on the fixed versions are not affected.
No product ranges from the sources yet.
bench version or by looking at the hrms app version in the bench apps list15.58.3 (15.x branch) or 16.4.3 (16.x branch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-64862")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.