CVE-2026-126414 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS, an open-source HR system, has record update endpoints that skip an ownership check. A logged-in employee can modify records that belong to other employees.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Companies that run Frappe HRMS for their staff are exposed, because any user with the Employee role can reach the affected endpoints. Installations on fixed versions, or with no Employee-role accounts, are not exposed to this flaw.
Not affected if fixed-version
Who cares erpnext, frappe-hrms, self-hosted
bench version or the hrms entry in the app's pyproject.toml.15.64.2 or 16.x below 16.20.0.15.64.2 or later.16.20.0 or later.Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.