Medium
5.3
Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records
CVE-2026-126313
First seen on SecPulse
Summary
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| frappehrms |
≥ 16.0.0, < 16.20.1→ 16.20.1 |
16.20.1 |