CVE-2026-126411: Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Frappe HRMS versions from 16.0.0 before 16.50.0 are affected. The issue applies to authenticated users, including accounts that have only the Employee role.
What could a low-privileged attacker do?
A logged-in user can access candidate record details and employee email addresses that they are not authorized to view. They can also cause emails to be sent to employees.
Does exploitation require user interaction or elevated permissions?
No user interaction is required. Exploitation requires an authenticated account, but the account can have only the Employee role.