CVE-2026-126314 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 do not check access to each employee on endpoints that create records in bulk. A logged-in user with create permission, such as an HR User, can create records for employees outside their permission scope, including employees of other companies.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted or managed Frappe HRMS on the affected 15.x or 16.x lines where users have create permission on HR record types and are restricted by company or user permissions. An attacker needs a valid account with that create permission, so instances without multi-company restrictions or with only read-only HR users are lower risk. Instances already on the fixed versions are not affected.
Not affected if fixed-version, no-create-permission, single-company
Who cares erpnext, frappe-hrms, hr-software, self-hosted
bench version or the hrms entry in the app list.15.0.0 up to 15.64.6, or 16.0.0 up to 16.20.1.Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
15.64.6 for the 15.x line16.20.1 for the 16.x line