CVE-2026-64862

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64862
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64862.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64862
Aliases
  • GHSA-wfc6-cw72-cvhx
Published
2026-10-16T20:52:53Z
Modified
2026-10-17T10:45:39Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
Details

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-862"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64862.json"
}
References

Affected packages

Git / github.com/frappe/hrms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/hrms
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
29e241295ebebbc1ce7c8be19eb91748b82c2311
Introduced
19a835b7ca10132365a8707931d65381aa68a846
Fixed
d9154fedc46167e0c7444b2ae4cf7703f7684a7f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "15.58.3"
        },
        {
            "introduced":  "16.0.0"
        },
        {
            "fixed":  "16.4.3"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.0.0
v15.*
v15.0.0
v15.1.0
v15.10.0
v15.11.0
v15.11.1
v15.12.0
v15.13.0
v15.13.1
v15.14.0
v15.14.1
v15.14.2
v15.15.0
v15.16.0
v15.17.0
v15.18.0
v15.19.0
v15.2.0
v15.20.0
v15.20.1
v15.20.2
v15.20.3
v15.21.0
v15.21.1
v15.21.2
v15.22.0
v15.22.1
v15.22.2
v15.22.3
v15.23.0
v15.23.1
v15.24.0
v15.25.0
v15.25.1
v15.25.2
v15.26.0
v15.27.0
v15.27.1
v15.27.2
v15.28.0
v15.28.1
v15.28.2
v15.28.3
v15.29.0
v15.3.0
v15.30.0
v15.31.0
v15.32.0
v15.32.1
v15.32.2
v15.33.0
v15.33.1
v15.33.2
v15.34.0
v15.35.0
v15.35.1
v15.35.2
v15.35.3
v15.36.0
v15.36.1
v15.37.0
v15.37.1
v15.37.2
v15.38.0
v15.38.1
v15.38.2
v15.38.3
v15.39.0
v15.39.1
v15.39.2
v15.4.0
v15.4.1
v15.40.0
v15.41.0
v15.42.0
v15.42.1
v15.42.2
v15.42.3
v15.43.0
v15.43.1
v15.44.0
v15.44.1
v15.44.2
v15.45.0
v15.45.1
v15.45.2
v15.45.3
v15.46.0
v15.46.1
v15.47.0
v15.47.1
v15.47.2
v15.47.3
v15.47.4
v15.47.5
v15.47.6
v15.47.7
v15.47.8
v15.48.0
v15.48.1
v15.49.0
v15.49.1
v15.49.2
v15.5.0
v15.50.0
v15.50.1
v15.50.2
v15.50.3
v15.51.0
v15.52.0
v15.52.1
v15.52.2
v15.52.3
v15.52.4
v15.52.5
v15.53.0
v15.54.0
v15.54.1
v15.54.2
v15.54.3
v15.55.0
v15.56.0
v15.57.0
v15.57.1
v15.58.0
v15.58.1
v15.58.2
v15.6.0
v15.7.0
v15.7.1
v15.8.0
v15.9.0
v15.9.1
v15.9.2
v16.*
v16.0.0
v16.0.1
v16.0.2
v16.1.0
v16.2.0
v16.3.0
v16.3.1
v16.4.0
v16.4.1
v16.4.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64862.json"