Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.4

Frappe HRMS lets authorized users add records for any employee

CVE-2026-126314 · published 1 day ago
Summary

In versions before 15.64.6 and 16.20.1, the system does not verify each employee when creating multiple records at once. A user who can create a record can also create it for employees they shouldn’t manage, potentially across different companies. Update to the latest version or apply the vendor’s patch to enforce proper employee checks.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
frappe hrms < 15.64.6
< 16.20.1
Original advisory text
Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
9.4 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published13 Nov 2026
Updated15 Nov 2026
First seen13 Nov 2026
Sources
CVE-2026-126314 · NVD
CVE-2026-126314 · MITRE
CVE-2026-126314 · OSV
GHSA-m8m7-r43p-2jjf · GHSA
Track software like this
Free during beta