CVE-2026-126414: Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HRMSto a version that resolves this vulnerability.Fixed in 15.64.2 - Upgrade
Upgrade
Frappe HRMSto a version that resolves this vulnerability.Fixed in 16.20.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are Frappe HRMS 15.0.0 through versions before 15.64.2, and 16.0.0 through versions before 16.20.0.
What access does an attacker need to exploit this issue?
An attacker must be authenticated and have the Employee role. No user interaction is required, and the vulnerable endpoints can be reached over the network.
What could an attacker do?
An authenticated Employee-role user can modify records belonging to other employees through certain record update endpoints, bypassing the intended ownership restriction. The reported impact includes compromise of confidentiality, integrity, and availability.
What versions address the issue?
Upgrade Frappe HRMS to 15.64.2 or later in the 15.x line, or to 16.20.0 or later in the 16.x line.