CVE-2026-126412 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS, an open-source HR system, has a bulk record action that skips its write permission check. An authenticated user with only read access can create and submit records for every covered employee.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Frappe HRMS deployments on the affected version ranges are exposed. Any logged-in user with the default Employee role can trigger the bulk action, so the risk is internal rather than anonymous internet access. Instances that do not run HRMS can skip it.
Not affected if already-patched-version, hrms-not-installed
Who cares erpnext, frappe, hrms, self-hosted
bench version or the hrms entry in the app's pyproject.toml15.64.116.19.0Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.