{"id":"CVE-2026-64862","kind":"vulnerability","aliases":["CVE-2026-64862"],"related":[],"title":"Frappe HRMS: PWA API lets employees read other employees' HR records","description":"Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.","summary":"Frappe HRMS PWA API endpoints for employee data do not consistently check that the requester owns the record. An authenticated user can request HR records belonging to other employees.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe","frappe-hrms","hr-software","package","self-hosted"],"not_affected_if":["fixed-version","no-hrms-app"],"how_to_check":"- Check the installed HRMS version with `bench version` or by looking at the `hrms` app version in the bench apps list\n- Confirm whether the PWA API endpoints are in use for employee self-service","fix":"- Upgrade the Frappe HRMS app to `15.58.3` (15.x branch) or `16.4.3` (16.x branch)","status":"open","published_at":"2026-10-16T21:19:19+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:57:43+00:00","updated_at":"2026-10-25T03:57:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:57:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Frappe HRMS app to `15.58.3` (15.x branch) or `16.4.3` (16.x branch)","reach":"internet","title":"Frappe HRMS: PWA API lets employees read other employees' HR records","impact":"medium","summary":"Frappe HRMS PWA API endpoints for employee data do not consistently check that the requester owns the record. An authenticated user can request HR records belonging to other employees.","category":"package","nicknames":[],"who_cares":["frappe","frappe-hrms","self-hosted","hr-software"],"confidence":0.7,"needs_auth":"yes","worst_case":"Logged-in user reads other employees' sensitive HR records","analyst_note":"","how_to_check":"- Check the installed HRMS version with `bench version` or by looking at the `hrms` app version in the bench apps list\n- Confirm whether the PWA API endpoints are in use for employee self-service","needs_analyst":false,"not_affected_if":["fixed-version","no-hrms-app"],"who_is_affected":"Sites running the Frappe HRMS app on a version before 15.58.3 or 16.4.3 with the PWA employee API reachable by logged-in users. Exposure depends on the authenticated users who can reach the endpoints; sites without the HRMS app or already on the fixed versions are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000587,"input_tokens":3367,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-64862':14A,17A '15.58.3':72C,131C '16.4.3':74C,133C 'access':117C 'anoth':99C,108C 'api':4A,32B,77C,90C,112C 'associ':97C,106C 'authent':48B,93C 'author':85C 'belong':54B,121C 'check':40B 'consist':39B,84C 'cve':12A,15A 'data':36B,81C,120C 'employe':6A,9A,35B,57B,80C,87C,100C,109C,124C 'employee-specif':86C 'endpoint':33B,78C,113C 'exploit':115C 'fix':128C 'frapp':1A,18B,20B,29B,58C 'frappe-hrm':19B 'host':28B 'hr':10A,23B,52B,59C,119C 'hr-softwar':22B 'hrms':2A,21B,30B,69C,75C 'human':65C 'issu':126C 'let':5A 'manag':67C 'open':63C 'open-sourc':62C 'own':44B 'packag':25B 'prior':70C 'pwa':3A,31B,76C,89C,111C 'read':7A 'record':11A,46B,53B,96C,105C 'request':43B,51B,91C,95C,104C 'resourc':66C 'self':27B 'self-host':26B 'sensit':118C 'softwar':24B 'solut':68C 'sourc':64C 'specif':88C 'success':114C 'user':49B,94C,102C 'version':130C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Frappe HRMS app on a version before 15.58.3 or 16.4.3 with the PWA employee API reachable by logged-in users. Exposure depends on the authenticated users who can reach the endpoints; sites without the HRMS app or already on the fixed versions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T21:19:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-64862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64862","severity":null,"published_at":"2026-10-16T21:19:19+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}