CVE-2026-126314Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Beschreibung

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-m8m7-r43p-2jjf) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation third-party-advisory