{"id":"CVE-2026-126313","kind":"vulnerability","aliases":["CVE-2026-126313"],"related":[],"title":"Frappe HRMS: employees can edit draft records belonging to others","description":"Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.","summary":"Frappe HRMS 16.0.0 before 16.20.1 is missing an ownership check on a record type employees can create. A logged-in user with only the Employee role can create or change draft records for another employee or for a company they do not belong to.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe-hrms","runtime","self-hosted"],"not_affected_if":["managed-hosting-patched","version-outside-range"],"how_to_check":null,"fix":"- Frappe HRMS: move to `16.20.1` or later.","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:57:25+00:00","updated_at":"2026-11-13T10:57:25+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:57:24Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS: move to `16.20.1` or later.","reach":"network","title":"Frappe HRMS: employees can edit draft records belonging to others","impact":"medium","summary":"Frappe HRMS 16.0.0 before 16.20.1 is missing an ownership check on a record type employees can create. A logged-in user with only the Employee role can create or change draft records for another employee or for a company they do not belong to.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frappe-hrms","self-hosted","erpnext"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated employees alter draft HR records belonging to others","analyst_note":"}","how_to_check":"- Check the installed Frappe HRMS version in the app's package or bench environment; versions `16.0.0` through `16.20.0` are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","managed-hosting-patched"],"who_is_affected":"Companies running self-hosted Frappe HRMS 16.0.0 through 16.20.0 where employees have accounts with the Employee role. Access is limited to draft records, and an attacker must already be logged in. Instances on other versions or managed hosting that has already patched can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00071,"input_tokens":4588,"output_tokens":503,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126313':13A,16A '-2026':12A,15A '16.0.0':27B,71C '16.20.1':29B,73C 'anoth':59B,106C 'authent':92C 'author':76C 'belong':8A,68B,115C 'bypass':77C 'chang':55B,102C 'check':34B,81C 'compani':64B,111C 'contain':74C 'creat':41B,53B,91C,100C 'cve':11A,14A 'draft':6A,56B,103C 'edit':5A 'employe':3A,39B,50B,60B,89C,97C,107C 'erpnext':17B 'frapp':1A,19B,25B,69C 'frappe-hrm':18B 'hold':94C 'host':24B 'hrms':2A,20B,26B,70C 'log':44B 'logged-in':43B 'miss':31B,83C 'other':10A 'ownership':33B,80C 'record':7A,37B,57B,86C,104C 'role':51B,98C 'runtim':21B 'self':23B 'self-host':22B 'type':38B,87C 'user':46B,93C","nicknames":[],"mitigations":[],"who_affected":"Companies running self-hosted Frappe HRMS 16.0.0 through 16.20.0 where employees have accounts with the Employee role. Access is limited to draft records, and an attacker must already be logged in. Instances on other versions or managed hosting that has already patched can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappehrms","medium","runtime","selfhosted"],"campaign_type":null,"search_a":"'-126313':13A,16A '-2026':12A,15A 'belong':8A 'cve':11A,14A 'draft':6A 'edit':5A 'employe':3A 'frapp':1A 'hrms':2A 'other':10A 'record':7A","search_b":"'16.0.0':27B '16.20.1':29B 'anoth':59B 'belong':68B 'chang':55B 'check':34B 'compani':64B 'creat':41B,53B 'draft':56B 'employe':39B,50B,60B 'erpnext':17B 'frapp':19B,25B 'frappe-hrm':18B 'host':24B 'hrms':20B,26B 'log':44B 'logged-in':43B 'miss':31B 'ownership':33B 'record':37B,57B 'role':51B 'runtim':21B 'self':23B 'self-host':22B 'type':38B 'user':46B","search_c":"'16.0.0':71C '16.20.1':73C 'anoth':106C 'authent':92C 'author':76C 'belong':115C 'bypass':77C 'chang':102C 'check':81C 'compani':111C 'contain':74C 'creat':91C,100C 'draft':103C 'employe':89C,97C,107C 'frapp':69C 'hold':94C 'hrms':70C 'miss':83C 'ownership':80C 'record':86C,104C 'role':98C 'type':87C 'user':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:03:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126313","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126313","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144957,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-rh2j-fcxx-r67m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:03:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144958,"url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-authorization-bypass-via-employee-records","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}