Frappe HR Improper Authorization Vulnerability Allowing Unauthorized Access to Leave Details

A permission bypass vulnerability has been identified in Frappe HR versions prior to 16.5.0, allowing authenticated employees to access the leave details of other employees. This issue arises from inadequate authorization checks in the leave details API. The vulnerability has been addressed in version 16.5.0 by implementing proper employee-level access validation in the affected API endpoint.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive leave information of employees.

Remediation

Users are advised to update to Frappe HR version 16.5.0 or later, where this vulnerability has been fixed.