Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints
概要
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| frappehrms |
16.0.0 以上 16.50.0 未満→ 16.50.0 |
16.50.0 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.
出典: CVE.org (CVE Program・cvelistV5) NVD