What is CVE-2026-64862?

CVE-2026-64862 is a medium-severity vulnerability in Frappe Hrms, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-10-16.

How severe is CVE-2026-64862?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Auth bypass in Frappe Hrms

CVE-2026-64862

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can request records associated with another employee through PWA API endpoints. Successful exploitation can access sensitive HR data belonging to other employees. This issue is fixed in versions 15.58.3 and 16.4.3.

Vulnerability class: Broken Access Control

Published 2026-10-16.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Frappe Hrms — versions < 15.58.3, >= 16.0.0, < 16.4.3

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-64862?: CVE-2026-64862 is a medium-severity vulnerability in Frappe Hrms, classified under Missing Authorization. CVSS score: 6.5/10. Published 2026-10-16.
How severe is CVE-2026-64862?: Medium severity. CVSS v3 base score is 6.5 out of 10.