CVE-2026-126414Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints

Açıklama

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-87rf-mqrq-hmm3) vendor-advisory
• VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints third-party-advisory