Description
Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| frappe | hrms | 16.0.0 <16.20.0 | — |
| frappe | hrms | 15.0.0 <15.64.2 | — |