Description
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | hrms | 16.0.0 <16.20.1 | — |