{"id":"CVE-2026-126412","kind":"vulnerability","aliases":["CVE-2026-126412"],"related":[],"title":"Frappe HRMS: missing write check lets read-only users alter employee records","description":"Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.","summary":"Frappe HRMS, an open-source HR system, has a bulk record action that skips its write permission check. An authenticated user with only read access can create and submit records for every covered employee.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe","hrms","package","self-hosted"],"not_affected_if":["already-patched-version","hrms-not-installed"],"how_to_check":"- Check the installed HRMS version with `bench version` or the `hrms` entry in the app's `pyproject.toml`\n- Confirm whether your versions fall in 15.0.0 to before 15.64.1 or 16.0.0 to before 16.19.0","fix":"- Frappe HRMS 15.x: move to `15.64.1`\n- Frappe HRMS 16.x: move to `16.19.0`","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:48:57+00:00","updated_at":"2026-11-13T10:48:57+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS 15.x: move to `15.64.1`\n- Frappe HRMS 16.x: move to `16.19.0`","reach":"network","title":"Frappe HRMS: missing write check lets read-only users alter employee records","impact":"medium","summary":"Frappe HRMS, an open-source HR system, has a bulk record action that skips its write permission check. An authenticated user with only read access can create and submit records for every covered employee.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","hrms","self-hosted","erpnext"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated low-privilege users create and submit employee records in bulk","analyst_note":"","how_to_check":"- Check the installed HRMS version with `bench version` or the `hrms` entry in the app's `pyproject.toml`\n- Confirm whether your versions fall in 15.0.0 to before 15.64.1 or 16.0.0 to before 16.19.0","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hrms-not-installed","already-patched-version"],"who_is_affected":"Self-hosted Frappe HRMS deployments on the affected version ranges are exposed. Any logged-in user with the default Employee role can trigger the bulk action, so the risk is internal rather than anonymous internet access. Instances that do not run HRMS can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000738,"input_tokens":4614,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126412':16A,19A '-2026':15A,18A '15.0.0':64C '15.64.1':66C '16.0.0':68C '16.19.0':70C 'access':52B,87C 'action':39B,81C,106C 'allow':82C 'alter':11A 'authent':47B,96C 'bulk':37B,78C 'check':5A,45B,75C 'cover':60B,114C 'creat':54B,108C 'cve':14A,17A 'data':95C 'default':100C 'employe':12A,61B,101C,115C 'erpnext':20B 'everi':59B,113C 'frapp':1A,21B,27B,62C 'host':26B 'hr':33B 'hrms':2A,22B,28B,63C 'lack':71C 'let':6A 'miss':3A 'modifi':94C 'open':31B 'open-sourc':30B 'packag':23B 'permiss':44B,74C 'process':80C 'read':8A,51B,86C 'read-on':7A 'record':13A,38B,57B,79C,92C,111C 'relat':90C 'role':102C 'run':104C 'self':25B 'self-host':24B 'setup':91C 'skip':41B 'sourc':32B 'submit':56B,110C 'system':34B 'user':10A,48B,83C,97C 'write':4A,43B,73C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Frappe HRMS deployments on the affected version ranges are exposed. Any logged-in user with the default Employee role can trigger the bulk action, so the risk is internal rather than anonymous internet access. Instances that do not run HRMS can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappe","high","hrms","package","selfhosted"],"campaign_type":null,"search_a":"'-126412':16A,19A '-2026':15A,18A 'alter':11A 'check':5A 'cve':14A,17A 'employe':12A 'frapp':1A 'hrms':2A 'let':6A 'miss':3A 'read':8A 'read-on':7A 'record':13A 'user':10A 'write':4A","search_b":"'access':52B 'action':39B 'authent':47B 'bulk':37B 'check':45B 'cover':60B 'creat':54B 'employe':61B 'erpnext':20B 'everi':59B 'frapp':21B,27B 'host':26B 'hr':33B 'hrms':22B,28B 'open':31B 'open-sourc':30B 'packag':23B 'permiss':44B 'read':51B 'record':38B,57B 'self':25B 'self-host':24B 'skip':41B 'sourc':32B 'submit':56B 'system':34B 'user':48B 'write':43B","search_c":"'15.0.0':64C '15.64.1':66C '16.0.0':68C '16.19.0':70C 'access':87C 'action':81C,106C 'allow':82C 'authent':96C 'bulk':78C 'check':75C 'cover':114C 'creat':108C 'data':95C 'default':100C 'employe':101C,115C 'everi':113C 'frapp':62C 'hrms':63C 'lack':71C 'modifi':94C 'permiss':74C 'process':80C 'read':86C 'record':79C,92C,111C 'relat':90C 'role':102C 'run':104C 'setup':91C 'submit':110C 'user':83C,97C 'write':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T11:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126412","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126412","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145067,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-5643-8fxc-qpm2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T11:16:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145068,"url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-in-bulk-record-action","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}