{"id":"CVE-2026-126314","kind":"vulnerability","aliases":["CVE-2026-126314"],"related":[],"title":"Frappe HRMS: bulk record endpoints skip per-employee access checks","description":"Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.","summary":"Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 do not check access to each employee on endpoints that create records in bulk. A logged-in user with create permission, such as an HR User, can create records for employees outside their permission scope, including employees of other companies.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe-hrms","hr-software","package","self-hosted"],"not_affected_if":["fixed-version","no-create-permission","single-company"],"how_to_check":"- Check the installed HRMS version in the Frappe bench, for example `bench version` or the `hrms` entry in the app list.\n- Confirm whether the installed version is in the affected range: `15.0.0` up to `15.64.6`, or `16.0.0` up to `16.20.1`.\n- Review which users hold create permission on HR record types and whether user permissions restrict them by company.","fix":"- Frappe HRMS `15.64.6` for the 15.x line\n- Frappe HRMS `16.20.1` for the 16.x line","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:49:02+00:00","updated_at":"2026-11-13T10:49:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:49:02Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS `15.64.6` for the 15.x line\n- Frappe HRMS `16.20.1` for the 16.x line","reach":"network","title":"Frappe HRMS: bulk record endpoints skip per-employee access checks","impact":"medium","summary":"Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 do not check access to each employee on endpoints that create records in bulk. A logged-in user with create permission, such as an HR User, can create records for employees outside their permission scope, including employees of other companies.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","erpnext","self-hosted","hr-software"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user creates HR records for employees in other companies","analyst_note":"","how_to_check":"- Check the installed HRMS version in the Frappe bench, for example `bench version` or the `hrms` entry in the app list.\n- Confirm whether the installed version is in the affected range: `15.0.0` up to `15.64.6`, or `16.0.0` up to `16.20.1`.\n- Review which users hold create permission on HR record types and whether user permissions restrict them by company.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-create-permission","single-company"],"who_is_affected":"Teams running self-hosted or managed Frappe HRMS on the affected 15.x or 16.x lines where users have create permission on HR record types and are restricted by company or user permissions. An attacker needs a valid account with that create permission, so instances without multi-company restrictions or with only read-only HR users are lower risk. Instances already on the fixed versions are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000794,"input_tokens":4621,"output_tokens":663,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126314':14A,17A '-2026':13A,16A '15.0.0':32B,82C '15.64.6':34B,84C '16.0.0':36B,86C '16.20.1':38B,88C 'access':10A,42B,92C 'affect':116C 'authent':109C 'bulk':3A,52B,102C 'check':11A,41B,91C 'compani':79B,136C 'creat':49B,59B,67B,99C,112C,124C 'cve':12A,15A 'employe':9A,45B,70B,76B,95C,107C,127C,137C 'endpoint':5A,47B,97C 'erpnext':18B 'frapp':1A,20B,29B,80C 'frappe-hrm':19B 'host':28B 'hr':23B,64B,121C 'hr-softwar':22B 'hrms':2A,21B,30B,81C 'includ':75B,134C 'list':105C 'log':55B 'logged-in':54B 'outsid':71B,128C 'packag':25B 'per':8A 'per-employe':7A 'permiss':60B,73B,113C,132C 'record':4A,50B,68B,100C,117C,125C 'scope':74B,133C 'self':27B 'self-host':26B 'skip':6A 'softwar':24B 'type':118C 'user':57B,65B,110C,122C,131C 'user-permiss':130C 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted or managed Frappe HRMS on the affected 15.x or 16.x lines where users have create permission on HR record types and are restricted by company or user permissions. An attacker needs a valid account with that create permission, so instances without multi-company restrictions or with only read-only HR users are lower risk. Instances already on the fixed versions are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappehrms","high","hrsoftware","package","selfhosted"],"campaign_type":null,"search_a":"'-126314':14A,17A '-2026':13A,16A 'access':10A 'bulk':3A 'check':11A 'cve':12A,15A 'employe':9A 'endpoint':5A 'frapp':1A 'hrms':2A 'per':8A 'per-employe':7A 'record':4A 'skip':6A","search_b":"'15.0.0':32B '15.64.6':34B '16.0.0':36B '16.20.1':38B 'access':42B 'bulk':52B 'check':41B 'compani':79B 'creat':49B,59B,67B 'employe':45B,70B,76B 'endpoint':47B 'erpnext':18B 'frapp':20B,29B 'frappe-hrm':19B 'host':28B 'hr':23B,64B 'hr-softwar':22B 'hrms':21B,30B 'includ':75B 'log':55B 'logged-in':54B 'outsid':71B 'packag':25B 'permiss':60B,73B 'record':50B,68B 'scope':74B 'self':27B 'self-host':26B 'softwar':24B 'user':57B,65B 'version':31B","search_c":"'15.0.0':82C '15.64.6':84C '16.0.0':86C '16.20.1':88C 'access':92C 'affect':116C 'authent':109C 'bulk':102C 'check':91C 'compani':136C 'creat':99C,112C,124C 'employe':95C,107C,127C,137C 'endpoint':97C 'frapp':80C 'hr':121C 'hrms':81C 'includ':134C 'list':105C 'outsid':128C 'permiss':113C,132C 'record':100C,117C,125C 'scope':133C 'type':118C 'user':110C,122C,131C 'user-permiss':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:05:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126314","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144959,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-m8m7-r43p-2jjf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:05:32+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144960,"url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.6-missing-authorization-in-bulk-record-creation","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}