CVE-2026-126412: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action
Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.
Affected Software
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
Any authenticated user assigned the default Employee role can exploit the bulk action. The vulnerable permission model allows users with read-only access to the related setup record to modify data.
What access or interaction does an attacker need?
The attacker needs an authenticated HRMS account with the relevant read access; no user interaction is required. Exploitation is network-accessible and has low attack complexity.
Are default role assignments affected?
Yes. The advisory states that users with the default Employee role can run the action to create and submit records for every employee covered by the action.
Which releases need to be updated?
Affected releases are HRMS 15.0.0 through versions before 15.64.1, and 16.0.0 through versions before 16.19.0. Updating to 15.64.1 or 16.19.0, as applicable, addresses the affected ranges.