CVE-2026-40888

תיאור (מקור, אנגלית)

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

מדדים

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-29/7/2026

CWE

CWE-284

מוצרים מושפעים

frappe: frappe hr

קישורים

• https://github.com/frappe/hrms/security/advisories/GHSA-4375-7rxj-9hfx Vendor Advisory
• https://github.com/frappe/hrms/releases/tag/v15.58.1 Release Notes
• https://github.com/frappe/hrms/releases/tag/v16.4.1 Release Notes