Description
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | hrms | 16.0.0 <16.19.0 | — |
| frappe | hrms | 15.0.0 <15.64.1 | — |