CVE-2026-40888

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

CVSS 3.0

6.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 13% of CVEs (scores of 2026-10-25)

CWE

CWE-284

Published

2026-04-21

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• frappe:frappe_hr

References

• https://github.com/frappe/hrms/releases/tag/v15.58.1
• https://github.com/frappe/hrms/releases/tag/v16.4.1
• https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx

Check your stackJSON