What is GHSA-6jm7-ghf6-f2qr?

GHSA-6jm7-ghf6-f2qr is a security advisory published by GitHub Security Advisories with High severity. Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization...

Which CVE IDs does GHSA-6jm7-ghf6-f2qr cover?

GHSA-6jm7-ghf6-f2qr covers the following CVE IDs: CVE-2026-126414. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6jm7-ghf6-f2qr?

GHSA-6jm7-ghf6-f2qr has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-6jm7-ghf6-f2qrHighCVSS 8.8

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126414 →

📋 Description

Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain record update endpoints that lack an ownership check. Authenticated users with the Employee role can call these endpoints to modify records belonging to other employees, beyond their permitted role.

🔗 References (4)

https://github.com/frappe/hrms/security/advisories/GHSA-87rf-mqrq-hmm3
https://nvd.nist.gov/vuln/detail/CVE-2026-126414
https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.2-missing-authorization-in-record-update-endpoints
https://github.com/advisories/GHSA-6jm7-ghf6-f2qr