CVE-2026-126317
Received Received - Intake

Missing Authorization in Frappe HRMS Allows Unauthorized Company Data Access

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126317
EUVD
EUVD-2026-125203

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe hrms From 16.0.0 (inc) to 16.20.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in Frappe HRMS versions 16.0.0 to 16.20.0. It allows any authenticated user, including those with the Employee role, to read company details outside their permissions by querying an endpoint that lacks proper permission checks. Specifically, users can list all companies on the site along with their default currencies, even companies they are not authorized to access.

Detection Guidance

To detect this vulnerability, check if your Frappe HRMS version is between 16.0.0 and 16.20.0. You can verify the version by running: grep -r 'version' /path/to/frappe/hrms or checking the site's about page. Then, test if an authenticated user can access company details outside their permissions by querying the affected endpoint, such as /api/method/frappe.client.get_list with the Company doctype.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive company information, including details about all companies on the site and their default currencies. This could lead to data breaches, unauthorized disclosure of financial or operational details, and potential misuse of company data. The impact is higher for organizations with multiple companies configured in the system.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other data protection regulations due to unauthorized access to sensitive company and potentially personal data. It violates principles of data minimization, access control, and confidentiality, which are core requirements of these standards. Organizations may face legal penalties, reputational damage, and loss of trust from stakeholders.

Mitigation Strategies

Immediately upgrade Frappe HRMS to version 16.20.1 or later to apply the fix. There is no workaround available, so upgrading is required to prevent unauthorized access to company details. Verify the upgrade by checking the version and confirming the issue is resolved.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126317. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...