CVE-2026-126414

EUVD-2026-125029
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 38.95%
Common Weakness Enumeration
References
https://github.com/frappe/hrms/security/advisories/GHSA-87rf-mqrq-hmm3
https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.2-missing-authorization-in-record-update-endpoints