Description
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | hrms | 15.0.0 – < 15.64.6, 16.0.0 – < 16.20.1 | 15.64.6 |
References
- GitHub Security Advisory (GHSA-m8m7-r43p-2jjf) vendor-advisory
- VulnCheck Advisory: Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation third-party-advisory