CVE-2026-126314: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe HRMS versions from 15.0.0 before 15.64.6 and versions from 16.0.0 before 16.20.1 are affected.
What level of access does an attacker need?
An attacker must be authenticated and have create permission for an affected record type. For example, an HR User with the relevant create permission can exploit bulk-creation endpoints.
Can this cross company or user-permission boundaries?
Yes. The affected endpoints do not verify access for each employee in a supplied list, allowing records to be created for employees outside the user's assigned permission scope, including employees in other companies.