Is CVE-2026-108733 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108733?

CVE-2026-108733 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-108733

Description

Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without HR roles can name another employee's Leave Allocation in a POST request to zero its allocated leaves and wipe that employee's remaining leave balance.