CVE-2026-64862

Executive Summary

CVE-2026-64862 is a missing-authorization vulnerability (CWE-862) in Frappe HR, the open-source human resources management solution (HRMS), affecting versions prior to 15.58.3 and 16.4.3. The HRMS Progressive Web App (PWA) API endpoints for employee data fail to consistently enforce employee-specific authorization, allowing any authenticated user to request and retrieve records belonging to other employees. The impact is high-confidentiality disclosure of sensitive HR records, reflected in a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Technical Analysis

The root cause is an authorization gap best classified as CWE-862: Missing Authorization. Frappe HR exposes PWA-oriented API endpoints that return employee-associated records. The vulnerability is not that these endpoints are unauthenticated — the attack prerequisite is a valid, authenticated session (PR:L) — but that the endpoints "do not consistently authorize employee-specific PWA API requests." In practice this means that, for at least some endpoints in the PWA API surface, the application verifies that the caller is logged in but does not verify that the caller is entitled to the specific employee record being requested.

The attack surface is the set of HRMS PWA API endpoints that serve employee data. These endpoints are network-reachable (AV:N), interact with the application over ordinary HTTP requests, and require no special UI interaction beyond issuing the request (AC:L, UI:N). Because the flaw is an object-level authorization failure rather than a flaw in authentication, an attacker needs only low-privilege credentials to cross the employee boundary — no administrative role, no chained vulnerability, and no race condition are required.

The confidentiality impact is rated High (C:H) because the records in scope are employee-associated and, per the description, "sensitive HR data." Integrity and availability impacts are rated None (C/I/A: I:N/A:N) because the flaw is a read-side authorization bypass; no data modification or service disruption is described. The scope is Unchanged (S:U) — the vulnerable component is the same authorization boundary that is bypassed. Because the issue is described as inconsistent authorization across the PWA API endpoints, the completeness of any individual endpoint's check cannot be asserted from the available data; the full set of affected endpoints is not enumerated in the NVD description, and no code-level identifiers are available. Insufficient technical detail is available to name specific routes, controller methods, or parameters, and none should be inferred.

Exploitation Scenarios

The following chain is derived strictly from the NVD description; no public proof-of-concept exists, and the attack path is inferred from the vulnerability class (missing object-level authorization).

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-reachable Frappe HR deployment running a version below 15.58.3 or 16.4.3. Reachability of the PWA API surface can be observed through ordinary use of the HRMS PWA front end, which issues the employee-data API requests of interest. The attacker must possess any valid authenticated account — a self-service or ordinary employee account is sufficient given PR:L.

2. Triggering the flaw class. While authenticated, the attacker issues HRMS PWA API requests for employee data and manipulates the employee-referencing component of those requests — for example, swapping an identifier that refers to the attacker's own employee record with one that refers to another employee. Because employee-specific authorization is applied inconsistently, certain requests succeed where an object-level access check would be expected to deny them. The attacker does not need elevated privileges or user interaction from the victim employee.

3. Execution method (class level). This is an Insecure Direct Object Reference-class exploitation of a missing-authorization defect: the attacker directly requests objects they are not authorized to see, relying on the server to return them without verifying the caller's entitlement. Iterating over employee identifiers (sequential or otherwise enumerable values) yields records for employees other than the authenticated user.

4. Post-exploitation impact. Successive successful requests disclose sensitive HR data belonging to other employees. The data returned is read-only from the attacker's perspective — the description specifies no write capability. The primary downstream risk is bulk exfiltration of employee records and onward use for social engineering, identity theft, or further targeting within the organization.

No public PoC or exploit code is available; the preceding chain is inferred from vulnerability class and the description's statement that a user "can request records associated with another employee through PWA API endpoints."

Impact Assessment

Exploitation yields unauthorized read access to sensitive HR records of other employees, a direct hit to the confidentiality pillar (C:H). Given a typical HRMS dataset — identity data, employment terms, and other employee-associated records — successful exploitation enables mass disclosure of personnel information and the regulatory exposure that follows (e.g., privacy and data-protection obligations attached to employee personal data). The attack requires only low privileges (PR:L) and a single network request per record (AC:L, UI:N), so the barrier to enumeration at scale is minimal.

Blast radius is limited to the specific Frappe HR instance and to the employee records its PWA API endpoints return; scope is unchanged (S:U), and there is no described integrity or availability impact, so the vulnerability does not directly enable account takeover, code execution, or data tampering. The CVSS base score of 6.5 is Medium severity, driven by the combination of network reachability, low privilege requirement, and high confidentiality impact. Organizations running Frappe HR as their system of record for personnel data should treat the confidentiality exposure as operationally significant regardless of the Medium score. No EPSS score has been assigned by FIRST.org and no CISA KEV listing is identified; there is no observed exploit-in-the-wild evidence in the available data.

Detection Guidance

Sigma Rule

title: Potential Frappe HR PWA Employee Data Enumeration (CVE-2026-64862)
id: 7c1e9a42-3b6d-4f58-9a21-c0d4e8b6f113
status: experimental
description: Detects authenticated requests to Frappe HR PWA API endpoints enumerating employee records, consistent with missing object-level authorization (CWE-862).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-64862
author: valtersit.com threat intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-path|contains:
      - "/api/method/"
  selection_method:
    cs-uri-path|contains:
      - "pwa"
  selection_employee:
    cs-uri-query|contains:
      - "employee"
  filter_static:
    cs-method:
      - "GET"
  condition: selection_path and selection_method and selection_employee
fields:
  - c-ip
  - cs-uri-path
  - cs-uri-query
  - sc-status
falsepositives:
  - Legitimate HR administrators reviewing employee records
  - PWA front-end bulk loads by authorized HR staff
level: medium

YARA Rule

rule CVE_2026_64862_Frappe_HR_PWA_Authz_Probe
{
    meta:
        description = "Detects HTTP request artifacts targeting Frappe HR PWA API employee-data endpoints indicative of CVE-2026-64862 authorization probing"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-64862"
        cve = "CVE-2026-64862"
        author = "valtersit.com threat intelligence"
        severity = "medium"

    strings:
        $api = "/api/method/" ascii nocase
        $pwa = "pwa" ascii nocase
        $emp = "employee" ascii nocase
        $http = "HTTP/1." ascii

    condition:
        $http and $api and $pwa and $emp
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-64862 Frappe HR PWA employee-data API request (potential authz bypass)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/method/"; nocase; http.uri; content:"pwa"; nocase; http.uri; content:"employee"; nocase; classtype:attempted-recon; reference:cve,2026-64862; sid:202664862; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [http where http.request.method == "GET" and wildcard(http.request.uri.path, "*/api/method/*") and wildcard(http.request.uri.query, "*employee*")]
  [http where http.request.method == "GET" and wildcard(http.request.uri.path, "*/api/method/*") and wildcard(http.request.uri.query, "*employee*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=uri
| search uri="/api/method/*" AND uri="*pwa*" AND uri="*employee*"
| stats count values(uri) as uris values(status) as statuses by src_ip
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,">
  <rule id="202664862" level="7">
    <if_sid>31100</if_sid>
    <url>/api/method/</url>
    <regex type="pcre2">(?i)/api/method/.*pwa.*employee</regex>
    <description>CVE-2026-64862: Possible Frappe HR PWA employee-data authorization bypass request from $(srcip)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>frappe_hrms,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Note, however, that the NVD description states the issue is fixed in Frappe HR versions 15.58.3 and 16.4.3.

1. Immediate mitigations. Treat any Frappe HR instance below 15.58.3 / 16.4.3 as exposed. Restrict network access to the HRMS PWA API surface to trusted networks or VPN where operationally feasible; that is a blunt control and will not survive typical PWA usage patterns, so prioritize rate-limiting and tight access-log monitoring on PWA API traffic for enumerable employee-identifier access from ordinary accounts. Review and, where possible, temporarily narrow roles of low-privilege/self-service accounts that have no operational need for broad employee data.

2. Patch / upgrade steps. Upgrade Frappe HR to version 15.58.3 (v14/v15 line) or 16.4.3 (v16 line) per the upstream fix. Test in staging, verify PWA API authorization behavior with a non-privileged account attempting to request another employee's records, then deploy. Confirm the deployed build reports the fixed version.

3. Long-term hardening. Enforce server-side object-level authorization on every employee-data endpoint (a single authorization check per record, not per route), and add regression tests that exercise cross-employee access from a low-privilege account. Instrument access logs for anomalous enumeration patterns against the PWA API. Retain periodic authorization reviews of the PWA surface as part of the change-management process.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-64862
• Frappe HR project (upstream repository and release notes for 15.58.3 and 16.4.3): https://github.com/frappe/hrms
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• FRST.org EPSS (no score currently assigned for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-64862 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or in-the-wild exploitation have been reported for CVE-2026-64862 in the available data; no public PoC or Nuclei template is available.