CVE-2026-40888

MEDIUM

Frappe HR vulnerable to Improper Access Control

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2026-40888 has a selected CVSS score of 6.5 (medium).

Description

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 21, 2026 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

hrms

Browse frappe / hrms
CVE List< 15.58.1affected
< 16.4.1affected

References

3