CVE-2026-126317: Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint
Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user can query the affected endpoint, including users that only have the Employee role. No elevated administrative permissions are required.
What information can an unauthorized user obtain?
An affected endpoint can be used to list every company on the site and each company's default currency, even when the requester does not have permission to view those company details.
Which versions need remediation?
Frappe HRMS versions from 16.0.0 before 16.20.1 are affected. Updating to 16.20.1 or later addresses the affected version range.
Are unauthenticated internet users affected?
The issue requires a logged-in account, so unauthenticated users cannot exploit it based on the available information. However, any account able to authenticate to the site may be able to access the data.