CVE-2026-126414
Received Received - Intake

Authentication Bypass in Frappe HRMS

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126414
EUVD
EUVD-2026-125029

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frappe hrms to 15.64.2 (exc)
frappe hrms to 16.20.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-126414 is a missing authorization vulnerability in Frappe HRMS versions 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0. Authenticated users with the Employee role can modify records belonging to other employees due to endpoints lacking ownership checks.

Detection Guidance

I don't know

Review Frappe HRMS logs for unauthorized record modifications by Employee role users. Check endpoints like /api/resource/Employee for unexpected PUT/POST requests.

Impact Analysis

This vulnerability allows unauthorized users to modify sensitive employee records, potentially leading to data breaches, incorrect information, or unauthorized access to confidential data.

Mitigation Strategies

Upgrade Frappe HRMS to versions 15.64.2 or later for 15.x and 16.20.0 or later for 16.x. Implement strict ownership validation in all record update endpoints.

Restrict Employee role permissions to prevent unauthorized record access. Monitor network traffic for suspicious API calls to HRMS endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...