CVE-2026-126317 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS from 16.0.0 before 16.20.1 has a missing permission check on an endpoint. Any logged-in user, including Employee role users, can list every company on the site with its default currency.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Frappe HRMS 16.0.0 through 16.20.0 where employees log in. Any authenticated user, including the Employee role, can reach the affected endpoint and see company names and default currencies. Sites where HRMS is not installed or is already on 16.20.1 or later are not affected.
Not affected if hrms-16.20.1-or-later, hrms-below-16.0.0
Who cares erpnext, frappe, frappe-hrms, self-hosted
bench version or the hrms entry in the app list.16.20.1 or later.Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.