Bulk Record Creation Access Bypass in Frappe HRMS

Executive Summary

Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 have a missing authorization vulnerability. Authenticated users with create permissions can exploit bulk record creation endpoints to generate records for employees outside their assigned scope, including employees from other companies. The system fails to verify access permissions for each employee during bulk operations.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review Frappe HRMS endpoints handling bulk record creation for employees. Check if authenticated users can access or modify records outside their assigned scope. Monitor logs for unusual bulk operations by HR Users or similar roles.

Useful 0 Not Useful 0

Impact Analysis

An attacker with HR User permissions could create unauthorized records for employees they should not access, potentially leading to data leaks, privilege escalation, or compliance violations. This includes creating records for employees in other companies within the same system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive employee data, violating GDPR's data protection principles and HIPAA's privacy rules. It may result in unauthorized data processing, disclosure, or breaches of confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Frappe HRMS to version 15.64.6 or later for HRMS 15.x, or 16.20.1 or later for HRMS 16.x. Restrict bulk record creation permissions to authorized users only and audit existing records for unauthorized changes.

Useful 0 Not Useful 0