CVE-2026-126413
Received Received - Intake

Frappe HRMS Missing Authorization in File Attachment Endpoint

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126413
EUVD
EUVD-2026-125030

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe hrms to 15.64.1 (exc)
frappe hrms to 16.19.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe HRMS versions 15.x before 15.64.1 and 16.x before 16.19.0 have a missing authorization vulnerability in an endpoint that returns file information. This allows authenticated users, including those with only the Employee role, to read details of files attached to records they do not have access to by querying the endpoint.

Detection Guidance

To detect this vulnerability, check if your Frappe HRMS instance is running version 15.x before 15.64.1 or 16.x before 16.19.0. Verify if the affected endpoint is accessible by authenticated users with low privileges.

Impact Analysis

An attacker with authenticated access could exploit this to view sensitive file attachments on records they should not be able to access, potentially exposing confidential or proprietary information. This could lead to data leaks or unauthorized access to internal documents.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by allowing unauthorized access to sensitive personal or health information. It undermines data protection controls and may result in regulatory penalties or loss of trust.

Mitigation Strategies

Immediately update Frappe HRMS to version 15.64.1 or later for 15.x, or 16.19.0 or later for 16.x. Ensure proper authorization checks are enforced on file attachment endpoints to restrict access to authorized users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126413. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...