GHSA-5643-8fxc-qpm2: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action
Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.
Frequently Asked Questions
Which deployments are affected?
Frappe HRMS versions 15.0.0 through before 15.64.1, and 16.0.0 through before 16.19.0, are affected.
Who can exploit this issue?
An authenticated user with read access to the related setup record can exploit the missing write-permission check. The advisory states that users with the default Employee role can run the bulk action.
What could an attacker do?
The user can invoke the bulk record processing action to create and submit records for every employee covered by that action, despite lacking write permission.
Are default-role users affected?
Yes. The default Employee role is specifically identified as able to run the vulnerable action.