---
id: "CVE-2026-126414"
page: "https://infrastack.ai/live/CVE-2026-126414"
kind: "vulnerability"
aliases: ["CVE-2026-126414"]
title: "Frappe HRMS: employees can edit other employees' records"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["erpnext", "frappe-hrms", "package", "self-hosted"]
not_affected_if: ["fixed-version"]
published_at: "2026-11-13T10:17:46+00:00"
first_seen_at: "2026-11-13T10:47:20+00:00"
updated_at: "2026-11-13T10:48:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126414", "first_seen_at": "2026-11-13T10:47:20+00:00"}]
exploit_sources: []
---

# Frappe HRMS: employees can edit other employees' records

Link for people: https://infrastack.ai/live/CVE-2026-126414 (this .md is for agents)

Frappe HRMS, an open-source HR system, has record update endpoints that skip an ownership check. A logged-in employee can modify records that belong to other employees.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version: `bench version` or the `hrms` entry in the app's `pyproject.toml`.
- Confirm whether any version shown is 15.x below `15.64.2` or 16.x below `16.20.0`.

## Fix

- Frappe HRMS 15.x: move to `15.64.2` or later.
- Frappe HRMS 16.x: move to `16.20.0` or later.

## Timeline

- 2026-11-13T10:47:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126414

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-87rf-mqrq-hmm3
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.2-missing-authorization-in-record-update-endpoints

## From the sources

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_