CVE-2026-126313
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.