CVE-2026-126411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126411
Aliases
  • GHSA-x3q4-g9rf-5c7r
Published
2026-11-13T09:35:40Z
Modified
2026-11-14T02:47:28Z
Severity
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints
Details

Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126411.json"
}
References

Affected packages

Git / github.com/frappe/hrms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/hrms
Events
Introduced
19a835b7ca10132365a8707931d65381aa68a846
Fixed
7c037698ce57d1492f05a8b4a586a7578f722879
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.50.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.2
v16.1.0
v16.10.0
v16.10.1
v16.11.0
v16.12.0
v16.12.1
v16.12.2
v16.13.0
v16.14.0
v16.15.0
v16.16.0
v16.17.0
v16.17.1
v16.18.0
v16.18.1
v16.19.0
v16.2.0
v16.20.0
v16.20.1
v16.3.0
v16.3.1
v16.4.0
v16.4.1
v16.4.2
v16.4.3
v16.4.4
v16.4.5
v16.4.6
v16.4.7
v16.4.8
v16.49.0
v16.5.0
v16.5.1
v16.5.2
v16.5.3
v16.5.4
v16.6.0
v16.6.1
v16.7.0
v16.7.1
v16.8.0
v16.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126411.json"