CVE-2026-126413: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe HRMS 15.x releases before 15.64.1 and 16.x releases before 16.19.0 are affected.
What access does an attacker need?
An attacker needs a valid authenticated account. Even a user assigned only the Employee role can query the affected endpoint.
What information can be exposed?
The endpoint can disclose details of files attached to records the user is not authorized to access. It can also allow the user to confirm whether records exist across document types.
Are unauthenticated users or users without elevated roles affected by the access requirement?
Unauthenticated access is not described. Elevated privileges are not required, because any logged-in user, including an Employee-role user, can exploit the issue.