{"id":"CVE-2026-126317","kind":"vulnerability","aliases":["CVE-2026-126317"],"related":[],"title":"Frappe HRMS: any logged-in user can list all companies and currencies","description":"Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.","summary":"Frappe HRMS from 16.0.0 before 16.20.1 has a missing permission check on an endpoint. Any logged-in user, including Employee role users, can list every company on the site with its default currency.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","frappe-hrms","package","self-hosted"],"not_affected_if":["hrms-16.20.1-or-later","hrms-below-16.0.0"],"how_to_check":"- Check the installed HRMS version with `bench version` or the `hrms` entry in the app list.\n- Confirm the installed version falls in the range 16.0.0 up to but not including 16.20.1.","fix":"- Frappe HRMS: move to `16.20.1` or later.","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:49:01+00:00","updated_at":"2026-11-13T10:49:01+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:49:01Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS: move to `16.20.1` or later.","reach":"internet","title":"Frappe HRMS: any logged-in user can list all companies and currencies","impact":"low","summary":"Frappe HRMS from 16.0.0 before 16.20.1 has a missing permission check on an endpoint. Any logged-in user, including Employee role users, can list every company on the site with its default currency.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","frappe-hrms","self-hosted","erpnext"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users read company names and default currencies site-wide","analyst_note":"","how_to_check":"- Check the installed HRMS version with `bench version` or the `hrms` entry in the app list.\n- Confirm the installed version falls in the range 16.0.0 up to but not including 16.20.1.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hrms-below-16.0.0","hrms-16.20.1-or-later"],"who_is_affected":"Sites running Frappe HRMS 16.0.0 through 16.20.0 where employees log in. Any authenticated user, including the Employee role, can reach the affected endpoint and see company names and default currencies. Sites where HRMS is not installed or is already on 16.20.1 or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4601,"output_tokens":538,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126317':16A,19A '-2026':15A,18A '16.0.0':32B,66C '16.20.1':34B,68C 'affect':103C 'allow':75C 'along':112C 'authent':76C 'author':72C 'check':39B,90C 'compani':11A,55B,80C,108C 'contain':69C 'currenc':13A,62B,116C 'cve':14A,17A 'default':61B,115C 'detail':81C 'due':85C 'employe':49B,97C 'endpoint':42B,104C 'erpnext':20B 'everi':54B,107C 'frapp':1A,21B,23B,29B,63C 'frappe-hrm':22B 'host':28B 'hrms':2A,24B,30B,64C 'includ':48B,96C 'list':9A,53B,106C 'log':5A,45B,93C 'logged-in':4A,44B,92C 'miss':37B,71C,88C 'outsid':82C 'packag':25B 'permiss':38B,84C,89C 'queri':101C 'read':79C 'role':50B,98C 'self':27B 'self-host':26B 'site':58B,111C 'user':7A,47B,51B,77C,95C,99C 'vulner':73C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe HRMS 16.0.0 through 16.20.0 where employees log in. Any authenticated user, including the Employee role, can reach the affected endpoint and see company names and default currencies. Sites where HRMS is not installed or is already on 16.20.1 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappe","frappehrms","high","package","selfhosted"],"campaign_type":null,"search_a":"'-126317':16A,19A '-2026':15A,18A 'compani':11A 'currenc':13A 'cve':14A,17A 'frapp':1A 'hrms':2A 'list':9A 'log':5A 'logged-in':4A 'user':7A","search_b":"'16.0.0':32B '16.20.1':34B 'check':39B 'compani':55B 'currenc':62B 'default':61B 'employe':49B 'endpoint':42B 'erpnext':20B 'everi':54B 'frapp':21B,23B,29B 'frappe-hrm':22B 'host':28B 'hrms':24B,30B 'includ':48B 'list':53B 'log':45B 'logged-in':44B 'miss':37B 'packag':25B 'permiss':38B 'role':50B 'self':27B 'self-host':26B 'site':58B 'user':47B,51B","search_c":"'16.0.0':66C '16.20.1':68C 'affect':103C 'allow':75C 'along':112C 'authent':76C 'author':72C 'check':90C 'compani':80C,108C 'contain':69C 'currenc':116C 'default':115C 'detail':81C 'due':85C 'employe':97C 'endpoint':104C 'everi':107C 'frapp':63C 'hrms':64C 'includ':96C 'list':106C 'log':93C 'logged-in':92C 'miss':71C,88C 'outsid':82C 'permiss':84C,89C 'queri':101C 'read':79C 'role':98C 'site':111C 'user':77C,95C,99C 'vulner':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:07:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126317","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126317","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144965,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-v72r-rg45-x9rh","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:07:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144966,"url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-missing-authorization-in-company-details-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}