---
id: "CVE-2026-64862"
kind: "vulnerability"
aliases: ["CVE-2026-64862"]
title: "Frappe HRMS: PWA API lets employees read other employees' HR records"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frappe", "frappe-hrms", "hr-software", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-hrms-app"]
published_at: "2026-10-16T21:19:19+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-25T03:57:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64862", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# Frappe HRMS: PWA API lets employees read other employees' HR records

Frappe HRMS PWA API endpoints for employee data do not consistently check that the requester owns the record. An authenticated user can request HR records belonging to other employees.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version with `bench version` or by looking at the `hrms` app version in the bench apps list
- Confirm whether the PWA API endpoints are in use for employee self-service

## Fix

- Upgrade the Frappe HRMS app to `15.58.3` (15.x branch) or `16.4.3` (16.x branch)

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-64862

## From the sources

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_