CVE-2026-126313: Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with only the Employee role can exploit it. No elevated administrative role or user interaction is required.
What unauthorized actions are possible?
Affected users can create or modify draft records associated with another employee or with a company they do not belong to. The issue affects a record type that employees are permitted to create.
Which versions are affected?
Frappe HRMS versions starting at 16.0.0 and before 16.20.1 are affected. Updating to 16.20.1 or later addresses the affected version range.