Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-126412: Frappe HRMS lets read‑only users change employee data
CVE-2026-126412 · published 1 day ago
Summary
In certain versions of Frappe HRMS, the system does not check if a user is allowed to write when performing a bulk action. This means that people who only have view rights can still create or modify employee records. Upgrade to the latest release or apply the vendor's patch to enforce proper permission checks.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| frappe | hrms |
< 15.64.1 < 16.19.0 |
Original advisory text
Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action
Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.
References
- https://github.com/frappe/hrms/security/advisories/GHSA-5643-8fxc-qpm2 Vendor Advisory
- https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-a... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-1264... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-126412 Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Severity
9.4
Critical
Type
CWE-862Missing Authorization
Timeline
Published13 Nov 2026
Updated15 Nov 2026
First seen13 Nov 2026
Sources
CVE-2026-126412 · NVD
CVE-2026-126412 · MITRE
CVE-2026-126412 · OSV
GHSA-5643-8fxc-qpm2 · GHSA
Track software like this
Free during beta