{"id":"CVE-2026-126414","kind":"vulnerability","aliases":["CVE-2026-126414"],"related":[],"title":"Frappe HRMS: employees can edit other employees' records","description":"Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.","summary":"Frappe HRMS, an open-source HR system, has record update endpoints that skip an ownership check. A logged-in employee can modify records that belong to other employees.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["erpnext","frappe-hrms","package","self-hosted"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed HRMS version: `bench version` or the `hrms` entry in the app's `pyproject.toml`.\n- Confirm whether any version shown is 15.x below `15.64.2` or 16.x below `16.20.0`.","fix":"- Frappe HRMS 15.x: move to `15.64.2` or later.\n- Frappe HRMS 16.x: move to `16.20.0` or later.","status":"open","published_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","triaged_at":"2026-11-13T10:48:57+00:00","updated_at":"2026-11-13T10:48:57+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:48:57Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS 15.x: move to `15.64.2` or later.\n- Frappe HRMS 16.x: move to `16.20.0` or later.","reach":"network","title":"Frappe HRMS: employees can edit other employees' records","impact":"medium","summary":"Frappe HRMS, an open-source HR system, has record update endpoints that skip an ownership check. A logged-in employee can modify records that belong to other employees.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","self-hosted","erpnext"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"employee accounts can alter other employees' HR records","analyst_note":"","how_to_check":"- Check the installed HRMS version: `bench version` or the `hrms` entry in the app's `pyproject.toml`.\n- Confirm whether any version shown is 15.x below `15.64.2` or 16.x below `16.20.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-version"],"who_is_affected":"Companies that run Frappe HRMS for their staff are exposed, because any user with the Employee role can reach the affected endpoints. Installations on fixed versions, or with no Employee-role accounts, are not exposed to this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4618,"output_tokens":498,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126414':11A,14A '-2026':10A,13A '15.0.0':55C '15.64.2':57C '16.0.0':59C '16.20.0':61C 'authent':77C 'author':65C 'belong':49B,90C 'beyond':94C 'call':84C 'certain':68C 'check':39B,76C 'contain':62C 'cve':9A,12A 'edit':5A 'employe':3A,7A,44B,52B,81C,93C 'endpoint':34B,71C,86C 'erpnext':15B 'frapp':1A,17B,23B,53C 'frappe-hrm':16B 'host':22B 'hr':29B 'hrms':2A,18B,24B,54C 'lack':73C 'log':42B 'logged-in':41B 'miss':64C 'modifi':46B,88C 'open':27B 'open-sourc':26B 'ownership':38B,75C 'packag':19B 'permit':96C 'record':8A,32B,47B,69C,89C 'role':82C,97C 'self':21B 'self-host':20B 'skip':36B 'sourc':28B 'system':30B 'updat':33B,70C 'user':78C 'vulner':66C","nicknames":[],"mitigations":[],"who_affected":"Companies that run Frappe HRMS for their staff are exposed, because any user with the Employee role can reach the affected endpoints. Installations on fixed versions, or with no Employee-role accounts, are not exposed to this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["erpnext","frappehrms","high","package","selfhosted"],"campaign_type":null,"search_a":"'-126414':11A,14A '-2026':10A,13A 'cve':9A,12A 'edit':5A 'employe':3A,7A 'frapp':1A 'hrms':2A 'record':8A","search_b":"'belong':49B 'check':39B 'employe':44B,52B 'endpoint':34B 'erpnext':15B 'frapp':17B,23B 'frappe-hrm':16B 'host':22B 'hr':29B 'hrms':18B,24B 'log':42B 'logged-in':41B 'modifi':46B 'open':27B 'open-sourc':26B 'ownership':38B 'packag':19B 'record':32B,47B 'self':21B 'self-host':20B 'skip':36B 'sourc':28B 'system':30B 'updat':33B","search_c":"'15.0.0':55C '15.64.2':57C '16.0.0':59C '16.20.0':61C 'authent':77C 'author':65C 'belong':90C 'beyond':94C 'call':84C 'certain':68C 'check':76C 'contain':62C 'employe':81C,93C 'endpoint':71C,86C 'frapp':53C 'hrms':54C 'lack':73C 'miss':64C 'modifi':88C 'ownership':75C 'permit':96C 'record':69C,89C 'role':82C,97C 'updat':70C 'user':78C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-29T11:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126414","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126414","severity":null,"published_at":"2026-11-13T10:17:46+00:00","modified_at":"2026-11-13T10:17:46+00:00","first_seen_at":"2026-11-13T10:47:20+00:00","fetched_at":"2026-11-13T10:47:20+00:00","note":null}],"documents":[{"id":145071,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-87rf-mqrq-hmm3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-29T11:17:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145072,"url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.2-missing-authorization-in-record-update-endpoints","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}