CVE-2026-40889

OVERVIEW CVE-2026-40889 is an authentication bypass vulnerability affecting Frappe HR, an open-source human resources management system (HRMS). The vulnerability exists in certain API endpoints and permits authenticated users to access unauthorized files beyond their proper permission scope. Frappe has addressed this issue in versions 15.58.2 and 16.4.2, with no known workarounds available for earlier versions. SEVERITY The vulnerability carries a CVSS score of 6.5 (Medium) with a network-based attack vector requiring low complexity and valid user credentials. The impact is limited to confidentiality breach, as the vulnerability allows unauthorized information disclosure without affecting system integrity or availability. The attack requires user authentication, which somewhat limits the overall risk profile compared to unauthenticated exploits. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The EPSS score of 0.00027 indicates minimal probability of exploitation, ranking below the 75th percentile of all known CVEs. The vulnerability is not listed on CISA's KEV catalog and remains inactive on vulnerability hot lists, suggesting low community attention and no available public exploit code at this time.