CVE-2026-126313 · Runtime
NO FIX YET · SEE WHAT TO DO
Frappe HRMS 16.0.0 before 16.20.1 is missing an ownership check on a record type employees can create. A logged-in user with only the Employee role can create or change draft records for another employee or for a company they do not belong to.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Companies running self-hosted Frappe HRMS 16.0.0 through 16.20.0 where employees have accounts with the Employee role. Access is limited to draft records, and an attacker must already be logged in. Instances on other versions or managed hosting that has already patched can skip it.
Not affected if managed-hosting-patched, version-outside-range
Who cares erpnext, frappe-hrms, self-hosted
Unknown from the sources.
16.20.1 or later.Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.