CVE-2026-126411 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS 16.0.0 before 16.50.0 has HR workflow endpoints without authorization checks. Any logged-in user, including one with only the Employee role, can read candidate details and employee email addresses and trigger emails to employees.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Frappe HRMS 16.0.0 through 16.49.x on their own or hosted sites, where any logged-in user (even with only the Employee role) can reach the affected HR endpoints. Sites on versions before 16.50.0 that have no HR workflow data exposed still need the update, and the sources do not say whether a configuration change alone is enough.
Not affected if version-16.50.0-or-later
Who cares frappe, frappe-hrms, self-hosted
bench version on a Frappe bench) and confirm whether it falls in 16.0.0 up to 16.50.0.16.50.0 or later.Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.