CVE-2026-126314
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.