CVE-2026-64862: Frappe HR Authentication Bypass Vulnerability

CVE-2026-64862 Overview

CVE-2026-64862 is a missing authorization vulnerability [CWE-862] in Frappe HR, an open-source human resources management solution (HRMS). Progressive Web App (PWA) API endpoints for employee data fail to consistently authorize employee-specific requests. An authenticated user can request records belonging to other employees through PWA API endpoints. Successful exploitation exposes sensitive HR data belonging to other employees across the organization. The flaw affects versions prior to 15.58.3 and 16.4.3, and is resolved in those releases.

Critical Impact

Any authenticated Frappe HR user can read sensitive HR records belonging to other employees via PWA API endpoints, resulting in a confidentiality breach of workforce data.

Affected Products

• Frappe HR versions prior to 15.58.3 (15.x branch)
• Frappe HR versions prior to 16.4.3 (16.x branch)
• Frappe HR PWA API endpoints exposing employee data

Discovery Timeline

• 2026-10-16 - CVE-2026-64862 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-64862

Vulnerability Analysis

Frappe HR exposes PWA API endpoints that return employee data for the mobile and offline-capable HRMS experience. These endpoints invoke backend helper functions that query the Employee doctype without consistently enforcing the record-level authorization model that Frappe applies elsewhere. An authenticated user supplies identifiers or filters referencing another employee and receives data they are not entitled to view. The issue is classified as Missing Authorization [CWE-862] and affects confidentiality of HR records such as personal details, employment metadata, and related fields exposed by the PWA endpoints. Integrity and availability are not impacted.

Root Cause

The root cause is use of frappe.get_all inside whitelisted PWA helper functions. In the Frappe framework, frappe.get_all bypasses permission checks, while frappe.get_list honors the user's document-level permissions. Because the employee listing helper used get_all, any authenticated session could retrieve records owned by other employees. The upstream fix swaps the call to frappe.get_list in hrms/api/__init__.py so the framework's permission model is applied on every query.

Attack Vector

Exploitation requires network access to the Frappe HR instance and valid, low-privilege authenticated credentials. No user interaction is required. The attacker issues an HTTP request to the vulnerable PWA endpoint, optionally supplying filters or identifiers to enumerate records belonging to other employees. The server returns the requested data without validating that the caller is entitled to the targeted employee's records.

# Security patch: hrms/api/__init__.py
@frappe.whitelist()
def get_all_employees() -> list[dict]:
-	return frappe.get_all(
+	return frappe.get_list(
 		"Employee",
 		fields=[
 			"name",

Source: GitHub Commit 6214ec8 and GitHub Commit eefb8f4. The one-line change replaces frappe.get_all (which bypasses permissions) with frappe.get_list (which enforces document-level permission checks).

Detection Methods for CVE-2026-64862

Indicators of Compromise

• Repeated HTTP requests from a single authenticated session to PWA API routes under /api/method/hrms.api.* that return large or sequential sets of Employee records.
• Access patterns where one user retrieves Employee documents whose user_id does not match the requesting account.
• Unusual spikes in response payload size from PWA employee endpoints relative to the user's historical baseline.

Detection Strategies

• Enable Frappe's request and audit logging for whitelisted API methods and review get_all_employees and related PWA endpoints for cross-employee access.
• Correlate authenticated session identifiers against the owner or user_id of returned Employee records to surface authorization anomalies.
• Hunt for user agents or client fingerprints associated with scripted enumeration of PWA endpoints rather than interactive PWA usage.

Monitoring Recommendations

• Forward Frappe HR application logs and reverse-proxy access logs to a centralized analytics platform for retention and querying.
• Alert on any non-administrator account that retrieves employee records at a rate or volume exceeding established baselines.
• Monitor deployment versions and alert when Frappe HR instances report a release older than 15.58.3 or 16.4.3.

How to Mitigate CVE-2026-64862

Immediate Actions Required

• Upgrade Frappe HR to 15.58.3 on the 15.x branch or 16.4.3 on the 16.x branch without delay.
• Audit recent access logs for PWA API calls that returned cross-employee data and notify affected individuals as required by applicable privacy regulations.
• Rotate API keys and session tokens for accounts that exhibited suspicious enumeration behavior.

Patch Information

The fix is published in GitHub Release v15.58.3 and GitHub Release v16.4.3. The code change is documented in GitHub Commit 6214ec8 and GitHub Commit eefb8f4. See the GitHub Security Advisory GHSA-wfc6-cw72-cvhx for upstream coordination details.

Workarounds

• No official workaround exists; apply the vendor patch.
• As a temporary compensating control, restrict network access to Frappe HR PWA endpoints through a reverse proxy or WAF rule limiting them to trusted ranges until the upgrade is deployed.
• Review and tighten role and permission assignments on the Employee doctype to minimize the blast radius of any residual authorization gaps.

# Upgrade Frappe HR using the bench CLI
bench get-app --branch version-15 hrms
bench --site <your-site> install-app hrms
bench update --apps hrms
# Verify the installed version is >= 15.58.3 or >= 16.4.3
bench version | grep hrms