What is GHSA-4m26-xw9c-53hv?

GHSA-4m26-xw9c-53hv is a security advisory published by GitHub Security Advisories with High severity. Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a...

Which CVE IDs does GHSA-4m26-xw9c-53hv cover?

GHSA-4m26-xw9c-53hv covers the following CVE IDs: CVE-2026-126412. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4m26-xw9c-53hv?

GHSA-4m26-xw9c-53hv has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-4m26-xw9c-53hvHighCVSS 8.8

Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126412 →

📋 Description

Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submit records for every covered employee.

🔗 References (4)

https://github.com/frappe/hrms/security/advisories/GHSA-5643-8fxc-qpm2
https://nvd.nist.gov/vuln/detail/CVE-2026-126412
https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-in-bulk-record-action
https://github.com/advisories/GHSA-4m26-xw9c-53hv