CVE-2026-126414Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints

Descripción

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Security Advisory (GHSA-87rf-mqrq-hmm3) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints third-party-advisory