CVE-2026-126414Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints

Beschreibung

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory (GHSA-87rf-mqrq-hmm3) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints third-party-advisory