CVE-2026-126413 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS versions before 15.64.1 (15.x line) and before 16.19.0 (16.x line) have an endpoint that returns file information without checking permissions. An authenticated user, including one with only the Employee role, can see details of files attached to records they cannot access and confirm that those records exist.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any Frappe HRMS instance with the affected versions and user accounts that can log in. The exposure is an endpoint that returns file metadata for any document type without a permission check, so the risk is highest where many employees hold logins. Instances on the fixed versions, or with no logged-in users beyond trusted staff, have less exposure.
Not affected if fixed-version, no-authenticated-users
Who cares erpnext, frappe-hrms, self-hosted
apps.json or with bench version on a Frappe bench.15.x or 16.x release below 15.64.1 or 16.19.0.15.64.1 or later.Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
16.19.0