{"id":"CVE-2026-126413","kind":"vulnerability","aliases":["CVE-2026-126413"],"related":[],"title":"Frappe HRMS: any logged-in user can read attachment details they should not see","description":"Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.","summary":"Frappe HRMS versions before 15.64.1 (15.x line) and before 16.19.0 (16.x line) have an endpoint that returns file information without checking permissions. An authenticated user, including one with only the Employee role, can see details of files attached to records they cannot access and confirm that those records exist.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe-hrms","package","self-hosted"],"not_affected_if":["fixed-version","no-authenticated-users"],"how_to_check":"- Check the installed HRMS version in the app's `apps.json` or with `bench version` on a Frappe bench.\n- Confirm whether the instance is on a `15.x` or `16.x` release below `15.64.1` or `16.19.0`.","fix":"- Frappe HRMS 15.x: upgrade to `15.64.1` or later.\n- Frappe HRMS 16.x: upgrade to `16.19.0` or later.","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:57:20+00:00","updated_at":"2026-11-13T10:57:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:57:20Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS 15.x: upgrade to `15.64.1` or later.\n- Frappe HRMS 16.x: upgrade to `16.19.0` or later.","reach":"network","title":"Frappe HRMS: any logged-in user can read attachment details they should not see","impact":"low","summary":"Frappe HRMS versions before 15.64.1 (15.x line) and before 16.19.0 (16.x line) have an endpoint that returns file information without checking permissions. An authenticated user, including one with only the Employee role, can see details of files attached to records they cannot access and confirm that those records exist.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","self-hosted","erpnext"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Logged-in users read attachment details and confirm record existence across document types","analyst_note":"product_name empty since no products listed; ecosystem unknown, the advisory at github.com may name the exact endpoint","how_to_check":"- Check the installed HRMS version in the app's `apps.json` or with `bench version` on a Frappe bench.\n- Confirm whether the instance is on a `15.x` or `16.x` release below `15.64.1` or `16.19.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version","no-authenticated-users"],"who_is_affected":"Any Frappe HRMS instance with the affected versions and user accounts that can log in. The exposure is an endpoint that returns file metadata for any document type without a permission check, so the risk is highest where many employees hold logins. Instances on the fixed versions, or with no logged-in users beyond trusted staff, have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000783,"input_tokens":4624,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126413':18A,21A '-2026':17A,20A '15':35B,83C '15.64.1':34B,86C '16':41B,88C '16.19.0':40B,91C 'access':74B,117C 'allow':104C 'attach':10A,69B,112C,135C 'authent':55B,105C 'author':95C 'cannot':73B,116C 'check':52B 'confirm':76B,142C 'contain':92C 'cve':16A,19A 'detail':11A,66B,109C,136C 'document':139C 'employe':62B,128C 'endpoint':46B,99C 'erpnext':22B 'exist':80B,144C 'file':49B,68B,102C,111C 'frapp':1A,24B,30B,81C 'frappe-hrm':23B 'host':29B 'hrms':2A,25B,31B,82C 'includ':57B,123C 'inform':50B,103C 'line':37B,43B 'log':5A,120C 'logged-in':4A,119C 'miss':94C 'one':58B,124C 'packag':26B 'permiss':53B 'queri':131C 'read':9A,108C 'record':71B,79B,114C,143C 'return':48B,101C 'role':63B,129C 'see':15A,65B 'self':28B 'self-host':27B 'type':140C 'user':7A,56B,106C,122C 'version':32B 'view':134C 'vulner':96C 'without':51B 'x':36B,42B,84C,89C","nicknames":[],"mitigations":[],"who_affected":"Any Frappe HRMS instance with the affected versions and user accounts that can log in. The exposure is an endpoint that returns file metadata for any document type without a permission check, so the risk is highest where many employees hold logins. Instances on the fixed versions, or with no logged-in users beyond trusted staff, have less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappehrms","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-126413':18A,21A '-2026':17A,20A 'attach':10A 'cve':16A,19A 'detail':11A 'frapp':1A 'hrms':2A 'log':5A 'logged-in':4A 'read':9A 'see':15A 'user':7A","search_b":"'15':35B '15.64.1':34B '16':41B '16.19.0':40B 'access':74B 'attach':69B 'authent':55B 'cannot':73B 'check':52B 'confirm':76B 'detail':66B 'employe':62B 'endpoint':46B 'erpnext':22B 'exist':80B 'file':49B,68B 'frapp':24B,30B 'frappe-hrm':23B 'host':29B 'hrms':25B,31B 'includ':57B 'inform':50B 'line':37B,43B 'one':58B 'packag':26B 'permiss':53B 'record':71B,79B 'return':48B 'role':63B 'see':65B 'self':28B 'self-host':27B 'user':56B 'version':32B 'without':51B 'x':36B,42B","search_c":"'15':83C '15.64.1':86C '16':88C '16.19.0':91C 'access':117C 'allow':104C 'attach':112C,135C 'authent':105C 'author':95C 'cannot':116C 'confirm':142C 'contain':92C 'detail':109C,136C 'document':139C 'employe':128C 'endpoint':99C 'exist':144C 'file':102C,111C 'frapp':81C 'hrms':82C 'includ':123C 'inform':103C 'log':120C 'logged-in':119C 'miss':94C 'one':124C 'queri':131C 'read':108C 'record':114C,143C 'return':101C 'role':129C 'type':140C 'user':106C,122C 'view':134C 'vulner':96C 'x':84C,89C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126413","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145069,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-p8rg-rfhr-fcx2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T11:17:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145070,"url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-on-file-details-endpoint","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}