Frappe HRMS, an open-source human resources management solution, contains an improper access control vulnerability (CWE-284) identified as CVE-2026-40888. This flaw allows an authenticated user with default privileges to access information they should not be authorized to view by exploiting specific API endpoints. The vulnerability affects versions earlier than 15.58.1 and 16.4.1. The vendor has released patched versions 15.58.1 and 16.4.1 that remediate the issue. There are no known workarounds, and the product is not a cloud service, so remediation depends on applying the vendor's patches.

Exploitation of this vulnerability allows an authenticated user with default roles to gain unauthorized access to sensitive information via certain API endpoints. The vulnerability does not impact system integrity or availability but compromises confidentiality. The CVSS 3.0 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Apply the official patches by upgrading Frappe HRMS to version 15.58.1 or 16.4.1 or later. No known workarounds exist, so patching is the only effective remediation. Since this is not a cloud service, the vendor does not manage remediation server-side. Monitor vendor advisories for any additional updates or guidance.