{"id":"CVE-2026-126411","kind":"vulnerability","aliases":["CVE-2026-126411"],"related":[],"title":"Frappe HRMS: missing authorization lets logged-in users read records and send emails","description":"Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.","summary":"Frappe HRMS 16.0.0 before 16.50.0 has HR workflow endpoints without authorization checks. Any logged-in user, including one with only the Employee role, can read candidate details and employee email addresses and trigger emails to employees.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe","frappe-hrms","package","self-hosted"],"not_affected_if":["version-16.50.0-or-later"],"how_to_check":"- Check the installed HRMS version in the app (for example `bench version` on a Frappe bench) and confirm whether it falls in 16.0.0 up to 16.50.0.\n- Review whether your site has HR workflow features in use (candidate records, employee emails).","fix":"- Frappe HRMS: move to `16.50.0` or later.","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:56:58+00:00","updated_at":"2026-11-13T10:56:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:56:58Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS: move to `16.50.0` or later.","reach":"internet","title":"Frappe HRMS: missing authorization lets logged-in users read records and send emails","impact":"medium","summary":"Frappe HRMS 16.0.0 before 16.50.0 has HR workflow endpoints without authorization checks. Any logged-in user, including one with only the Employee role, can read candidate details and employee email addresses and trigger emails to employees.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","self-hosted","frappe"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"logged-in users read candidate data and employee emails, trigger emails","analyst_note":"","how_to_check":"- Check the installed HRMS version in the app (for example `bench version` on a Frappe bench) and confirm whether it falls in 16.0.0 up to 16.50.0.\n- Review whether your site has HR workflow features in use (candidate records, employee emails).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-16.50.0-or-later"],"who_is_affected":"Teams running Frappe HRMS 16.0.0 through 16.49.x on their own or hosted sites, where any logged-in user (even with only the Employee role) can reach the affected HR endpoints. Sites on versions before 16.50.0 that have no HR workflow data exposed still need the update, and the sources do not say whether a configuration change alone is enough.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4614,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126411':17A,20A '-2026':16A,19A '16.0.0':31B,68C '16.50.0':33B,70C 'access':82C 'address':60B,110C 'authent':80C 'author':4A,39B,72C 'candid':55B,104C 'caus':112C 'certain':75C 'check':40B,73C 'cve':15A,18A 'detail':56B,106C 'email':14A,59B,63B,109C,113C 'employe':51B,58B,65B,100C,108C,118C 'endpoint':37B,78C 'frapp':1A,21B,23B,29B,66C 'frappe-hrm':22B 'host':28B 'hr':35B,76C 'hrms':2A,24B,30B,67C 'includ':46B,95C 'lack':71C 'let':5A,79C 'log':7A,43B,92C 'logged-in':6A,42B,91C 'miss':3A 'one':47B,96C 'packag':25B 'permit':87C 'read':10A,54B,103C 'record':11A,83C,105C 'role':52B,101C 'self':27B 'self-host':26B 'send':13A 'sent':116C 'trigger':62B 'user':9A,45B,81C,94C 'view':89C 'without':38B 'workflow':36B,77C","nicknames":[],"mitigations":[],"who_affected":"Teams running Frappe HRMS 16.0.0 through 16.49.x on their own or hosted sites, where any logged-in user (even with only the Employee role) can reach the affected HR endpoints. Sites on versions before 16.50.0 that have no HR workflow data exposed still need the update, and the sources do not say whether a configuration change alone is enough.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frappe","frappehrms","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-126411':17A,20A '-2026':16A,19A 'author':4A 'cve':15A,18A 'email':14A 'frapp':1A 'hrms':2A 'let':5A 'log':7A 'logged-in':6A 'miss':3A 'read':10A 'record':11A 'send':13A 'user':9A","search_b":"'16.0.0':31B '16.50.0':33B 'address':60B 'author':39B 'candid':55B 'check':40B 'detail':56B 'email':59B,63B 'employe':51B,58B,65B 'endpoint':37B 'frapp':21B,23B,29B 'frappe-hrm':22B 'host':28B 'hr':35B 'hrms':24B,30B 'includ':46B 'log':43B 'logged-in':42B 'one':47B 'packag':25B 'read':54B 'role':52B 'self':27B 'self-host':26B 'trigger':62B 'user':45B 'without':38B 'workflow':36B","search_c":"'16.0.0':68C '16.50.0':70C 'access':82C 'address':110C 'authent':80C 'author':72C 'candid':104C 'caus':112C 'certain':75C 'check':73C 'detail':106C 'email':109C,113C 'employe':100C,108C,118C 'endpoint':78C 'frapp':66C 'hr':76C 'hrms':67C 'includ':95C 'lack':71C 'let':79C 'log':92C 'logged-in':91C 'one':96C 'permit':87C 'read':103C 'record':83C,105C 'role':101C 'sent':116C 'user':81C,94C 'view':89C 'workflow':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T11:16:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126411","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126411","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145065,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-x3q4-g9rf-5c7r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T11:16:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145066,"url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.50.0-missing-authorization-in-hr-workflow-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}