This vulnerability affects the permission validation component of Frappe HR, specifically in the hrms/api/__init__.py file's functions get_expense_claims, get_shift_requests, and get_attendance_requests. An attacker can manipulate the employee argument to cause incorrect authorization, enabling unauthorized access to sensitive HR-related data or functions. Remote exploitation is possible without user interaction. The vendor has confirmed a fix has been implemented following earlier reports of this issue.

The vulnerability allows an attacker with low privileges to remotely exploit the system by manipulating input arguments to bypass authorization checks. This could lead to unauthorized access to expense claims, shift requests, and attendance requests data. The CVSS 4.0 base score is 5.3 (medium), reflecting the moderate impact and ease of exploitation without user interaction.

The vendor has confirmed that the issue has been fixed based on previous reports. Users should upgrade to a version later than 16.15.0 where the fix is applied. Since this is not a cloud service, applying the vendor's official patch or update is required to remediate the vulnerability.