Is CVE-2026-108732 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108732?

CVE-2026-108732 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-108732

Description

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR roles can call the method over /api/method with enumerable Salary Slip or claim document names to disclose other employees' net pay and loan, advance, and claim balances.