CVE-2026-126314Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Descripción

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-m8m7-r43p-2jjf) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation third-party-advisory