CVE-2026-126413Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint

Beschreibung

Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-p8rg-rfhr-fcx2) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint third-party-advisory