---
id: "CVE-2026-126413"
page: "https://infrastack.ai/live/CVE-2026-126413"
kind: "vulnerability"
aliases: ["CVE-2026-126413"]
title: "Frappe HRMS: any logged-in user can read attachment details they should not see"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe-hrms", "package", "self-hosted"]
not_affected_if: ["fixed-version", "no-authenticated-users"]
published_at: "2026-11-13T10:17:46+00:00"
first_seen_at: "2026-11-13T10:47:20+00:00"
updated_at: "2026-11-13T10:57:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126413", "first_seen_at": "2026-11-13T10:47:20+00:00"}]
exploit_sources: []
---

# Frappe HRMS: any logged-in user can read attachment details they should not see

Link for people: https://infrastack.ai/live/CVE-2026-126413 (this .md is for agents)

Frappe HRMS versions before 15.64.1 (15.x line) and before 16.19.0 (16.x line) have an endpoint that returns file information without checking permissions. An authenticated user, including one with only the Employee role, can see details of files attached to records they cannot access and confirm that those records exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version in the app's `apps.json` or with `bench version` on a Frappe bench.
- Confirm whether the instance is on a `15.x` or `16.x` release below `15.64.1` or `16.19.0`.

## Fix

- Frappe HRMS 15.x: upgrade to `15.64.1` or later.
- Frappe HRMS 16.x: upgrade to `16.19.0` or later.

## Timeline

- 2026-11-13T10:47:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126413

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-p8rg-rfhr-fcx2
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-on-file-details-endpoint

## From the sources

Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_