CVE-2026-126317
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.