CVE-2026-126411

MEDIUM 5.4

Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.

CWE	CWE-862
Vendor	frappe
Product	hrms
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for frappe hrms

Be the first to know when new medium vulnerabilities affecting frappe hrms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

frappe / hrms

16.0.0 < 16.50.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/hrms/security/advisories/GHSA-x3q4-g9rf-5c7r vulncheck.com: https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.50.0-missing-authorization-in-hr-workflow-endpoints

Credits

iamkhanraheel sakilahamed