{"id":"CVE-2026-126413","summary":"Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint","details":"Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint that returns file information, allowing authenticated users to read details of files attached to records they cannot access. Any logged-in user, including one with only the Employee role, can query it to view attachment details on any document type and confirm record existence.","aliases":["GHSA-p8rg-rfhr-fcx2"],"modified":"2026-11-14T02:47:28.153514151Z","published":"2026-11-13T09:35:38.506Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126413.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126413.json"},{"type":"ADVISORY","url":"https://github.com/frappe/hrms/security/advisories/GHSA-p8rg-rfhr-fcx2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126413"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/frappe-hrms-15.0.0-before-15.64.1-missing-authorization-on-file-details-endpoint"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/frappe/hrms","events":[{"introduced":"d7a4769bf4786b5a244b5b1a77b6be9ddf0547b3"},{"fixed":"e68a3deaa95ae5b2c3d743297d0a4ab505733fc1"},{"introduced":"19a835b7ca10132365a8707931d65381aa68a846"},{"fixed":"7e0fba4bf11a63ac7b21a717610e235310815c1a"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"15.0.0"},{"fixed":"15.64.1"}]},{"strategy":"StandardRange","range":[{"introduced":"16.0.0"},{"fixed":"16.19.0"}],"source":"AFFECTED_FIELD"}]}}],"versions":["v16.18.1","v15.64.0","v16.18.0","v15.63.4","v16.17.1","v15.63.3","v16.17.0","v16.16.0","v15.63.2","v16.15.0","v16.14.0","v15.63.1","v16.13.0","v15.63.0","v16.12.2","v15.62.2","v16.12.1","v15.62.1","v16.12.0","v16.11.0","v15.62.0","v16.10.1","v16.10.0","v15.61.0","v16.9.0","v15.60.4","v16.8.0","v16.4.0","v16.7.1","v15.60.3","v15.60.2","v16.7.0","v16.6.1","v15.60.1","v16.6.0","v15.60.0","v16.5.4","v15.59.2","v16.5.3","v15.59.1","v16.5.2","v16.5.1","v16.5.0","v15.59.0","v15.58.8","v16.4.8","v15.58.7","v16.4.7","v16.4.6","v15.58.6","v15.58.5","v16.4.5","v16.4.4","v15.58.4","v15.58.3","v16.4.3","v15.58.2","v16.4.2","v16.4.1","v15.58.1","v15.58.0","v15.57.1","v16.3.1","v16.3.0","v15.57.0","v16.2.0","v15.56.0","v15.55.0","v16.1.0","v16.0.2","v16.0.1","v16.0.0","v15.54.3","v15.54.2","v15.54.1","v15.54.0","v15.53.0","v15.52.5","v15.52.4","v15.52.3","v15.52.2","v15.52.1","v15.52.0","v15.51.0","v15.50.3","v15.50.2","v15.50.1","v15.50.0","v15.49.2","v15.49.1","v15.49.0","v15.48.1","v15.48.0","v15.47.8","v15.47.7","v15.47.6","v15.47.5","v15.47.4","v15.47.3","v15.47.2","v15.47.1","v15.47.0","v15.46.1","v15.46.0","v15.45.3","v15.45.2","v15.45.1","v15.45.0","v15.44.2","v15.44.1","v15.44.0","v15.43.1","v15.43.0","v15.42.3","v15.42.2","v15.42.1","v15.42.0","v15.41.0","v15.40.0","v15.39.2","v15.39.1","v15.39.0","v15.38.3","v15.38.2","v15.38.1","v15.38.0","v15.37.2","v15.37.1","v15.37.0","v15.36.1","v15.36.0","v15.35.3","v15.35.2","v15.35.1","v15.35.0","v15.34.0","v15.33.2","v15.33.1","v15.33.0","v15.32.2","v15.32.1","v15.32.0","v15.31.0","v15.30.0","v15.29.0","v15.28.3","v15.28.2","v15.28.1","v15.28.0","v15.27.2","v15.27.1","v15.27.0","v15.26.0","v15.25.2","v15.25.1","v15.25.0","v15.24.0","v15.23.1","v15.23.0","v15.22.3","v15.22.2","v15.22.1","v15.22.0","v15.21.2","v15.21.1","v15.21.0","v15.20.3","v15.20.2","v15.20.1","v15.20.0","v15.19.0","v15.18.0","v15.17.0","v15.16.0","v15.15.0","v15.14.2","v15.14.1","v15.14.0","v15.13.1","v15.13.0","v15.12.0","v15.11.1","v15.11.0","v15.10.0","v15.9.2","v15.9.1","v15.9.0","v15.8.0","v15.7.1","v15.7.0","v15.6.0","v15.5.0","v15.4.1","v15.4.0","v15.3.0","v15.2.0","v15.1.0","v15.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126413.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}]}