CVE-2026-126411Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints

Açıklama

Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-x3q4-g9rf-5c7r) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints third-party-advisory