Description
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses, and cause emails to be sent to employees.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | hrms | 16.0.0 – < 16.50.0 | 16.50.0 |
References
- GitHub Security Advisory (GHSA-x3q4-g9rf-5c7r) vendor-advisory
- VulnCheck Advisory: Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints third-party-advisory