中 5.3

Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records

CVE-2026-126313 SecPulse初出 18:36

概要

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.

影響パッケージ

種類	パッケージ	影響を受ける版 → 修正版	修正版
frappe	frappehrms	16.0.0 以上 16.20.1 未満→ 16.20.1	16.20.1

参照URL

• advisory GitHub Security Advisory (GHSA-rh2j-fcxx-r67m)
• advisory VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records