CVE-2026-108733 — Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method…
Published: 2026-10-11 · CVSS: 5.3 · CVSS 4.0
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7