---
id: "CVE-2026-126412"
page: "https://infrastack.ai/live/CVE-2026-126412"
kind: "vulnerability"
aliases: ["CVE-2026-126412"]
title: "Frappe HRMS: missing write check lets read-only users alter employee records"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe", "hrms", "package", "self-hosted"]
not_affected_if: ["already-patched-version", "hrms-not-installed"]
published_at: "2026-11-13T10:17:46+00:00"
first_seen_at: "2026-11-13T10:47:20+00:00"
updated_at: "2026-11-13T10:48:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126412", "first_seen_at": "2026-11-13T10:47:20+00:00"}]
exploit_sources: []
---

# Frappe HRMS: missing write check lets read-only users alter employee records

Link for people: https://infrastack.ai/live/CVE-2026-126412 (this .md is for agents)

Frappe HRMS, an open-source HR system, has a bulk record action that skips its write permission check. An authenticated user with only read access can create and submit records for every covered employee.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version with `bench version` or the `hrms` entry in the app's `pyproject.toml`
- Confirm whether your versions fall in 15.0.0 to before 15.64.1 or 16.0.0 to before 16.19.0

## Fix

- Frappe HRMS 15.x: move to `15.64.1`
- Frappe HRMS 16.x: move to `16.19.0`

## Timeline

- 2026-11-13T10:47:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126412

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-5643-8fxc-qpm2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-in-bulk-record-action

## From the sources

Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_