Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

CVE-2026-129429

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the getemployeedetails, computetaxcomparison and settaxregime methods of taxregimeselector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another...

CVE-2026-129429

The Frappe india-payroll software, in versions prior to 16.0.4 , is vulnerable to a missing authorization flaw within the tax_regime_selector.py file. Specifically, the get_employee_details, compute_tax_comparison, and set_tax_regime methods do not sufficiently restrict access, allowing authentic...

EUVD-2026-125907

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the getemployeedetails, computetaxcomparison and settaxregime methods of taxregimeselector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another...

CVE-2026-129429 Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the getemployeedetails, computetaxcomparison and settaxregime methods of taxregimeselector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another...

PT-2026-147415

Name of the Vulnerable Software and Affected Versions Frappe india-payroll versions prior to 16.0.4 Description Authenticated low-privileged users can access payroll data of other employees due to missing authorization in the tax regime selector.py file. By providing another employee identifier, ...

CVE-2026-129429: frappe india-payroll: Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details,…

Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the getemployeedetails, computetaxcomparison and settaxregime methods of taxregimeselector.py that allows authenticated low-privileged users to access other employees' payroll data. Attackers can supply another...

CVE-2026-126411

Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record details and employee email addresses,...

CVE-2026-126412

Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing action, allowing users with only read access to the related setup record to modify data. Authenticated users with the default Employee role can run the action to create and submi...

CVE-2026-126314

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

CVE-2026-126315

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores ar...

CVE-2026-126313

Frappe HRMS version 16.0.0 before 16.20.1 is vulnerable to an authorization bypass due to a missing ownership check on certain record types. This flaw allows authenticated users with only the Employee role to create or modify draft records belonging to other employees or companies they do not bel...

EUVD-2026-125207

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to...

CVE-2026-126313 Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to...

CVE-2026-126314 Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

EUVD-2026-125206

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

CVE-2026-126314 Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

CVE-2026-126314

Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 are vulnerable to a missing authorization flaw in bulk record creation endpoints. The application fails to verify individual employee access when creating records for multiple employees simultaneously. An authenticated user with...

CVE-2026-126315

Frappe HRMS versions 16.14.0 before 16.20.1 are vulnerable to a Telemetry Setting Bypass Information Exposure flaw. The application transmits product usage events for certain HR transactions without verifying the site's telemetry settings. This allows sensitive data, including leave type names, c...

CVE-2026-126315 Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores ar...