CVE-2026-126414
HIGH
NVD
CVSS Score
8.8
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.