CVE-2026-108732: Missing Authorization in frappe hrms

CVE-2026-108732 is a missing authorization vulnerability in Frappe HRMS prior to version 16.11.0. The vulnerability exists in the get_account_and_amount method, which is whitelisted and accessible via the /api/method endpoint. Authenticated users lacking HR roles can exploit this to enumerate Salary Slip or claim document names and retrieve sensitive payroll information such as net pay, loan, advance, and claim balances of other employees. This affects all versions from initial releases up to but not including 16.11.0.

The vulnerability allows unauthorized disclosure of sensitive payroll financial data to authenticated users who do not have HR privileges. This can lead to privacy violations and potential misuse of employee financial information. There is no indication of privilege escalation or remote code execution. The CVSS 4.0 base score is 5.3, indicating a medium severity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the API endpoint and review user role assignments to minimize exposure. Monitor for updates from the vendor regarding patches or official mitigations.