CVE-2026-126313: Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records

Versions reported by the vendor

Affected version ranges reported by the assigning authority (VulnCheck). Independent of NVD's CPE analysis and usually ahead of it.

• frappe hrms

  • 16.20.1not affected
  • 16.0.0 and later · before 16.20.1affected · semver

Other highest-scoring records for the same primary product.

• CVE-2026-126315Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
  37Monitor
• CVE-2026-126414Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints
  34Monitor
• CVE-2026-126412Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action
  34Monitor

Published before and after this one in the same product

• ← EarlierCVE-2026-64862Oct 16, 2026 · Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS
  26Monitor
• ← EarlierCVE-2026-121442Nov 3, 2026 · Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
  21Monitor
• Later →CVE-2026-126314Nov 13, 2026 · Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation
  34Monitor

Root cause

The endpoint fetches the record by the ID sent in the request, but never checks whether the record belongs to the requesting user.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const invoice = await Invoice.findById(req.params.id);2res.json(invoice);

1const invoice = await Invoice.findOne({2  id: req.params.id,3  ownerId: req.user.id,4});5if (!invoice) return res.sendStatus(404);6res.json(invoice);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.