Threats affecting pkg:github/frappe/hrms

Frappe HRMS versions prior to 15.58.3 and between 16.0.0 and before 16.4.3 contain a missing authorization vulnerability in their PWA API endpoints. Authenticated users can access employee data records belonging to other employees without proper authorization. This vulnerability allows unauthorized disclosure of sensitive HR data. The issue is fixed in versions 15.58.3 and 16.4.3.

CVE-2026-55796 is an SQL injection vulnerability in the Salary Payments via ECS report of Frappe HRMS. Versions prior to 15.60.3 and between 16.0.0 and before 16.7.1 allow authenticated HR users to inject SQL via crafted report filter values. This can lead to unauthorized access to sensitive database records. The issue is fixed in versions 15.60.3 and 16.7.1.

CVE-2026-111389 is a SQL injection vulnerability in Frappe HRMS affecting versions 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0. The flaw arises from missing input validation in certain endpoints, allowing any authenticated user, even with low privileges, to craft requests that can extract sensitive database information. The vulnerability has a high severity score of 8.3 (CVSS 4.0).

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. This issue is fixed in 16.7.0.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.5.0, authenticated employees could access other employees’ leave details due to improper authorization checks. This vulnerability is fixed in 16.5.0.

CVE-2026-41320 is a medium severity SQL injection vulnerability in the Frappe HRMS product. Versions prior to 15.54.0 and 14.38.1 are affected. An attacker can send a specially crafted request to a certain endpoint to extract unauthorized information via SQL injection. The vulnerability has been patched in versions 15.54.0 and 14.

CVE-2026-40889 is an improper access control vulnerability in Frappe HRMS versions prior to 15.58.2 and 16.4.2. Authenticated users can exploit certain API endpoints to access unauthorized files. The issue is resolved in versions 15.58.2 and 16.4.

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.