CVE-2026-126314

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

EUVD-2026-125206

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

CVE-2026-126314

Frappe HRMS versions 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 are vulnerable to a missing authorization flaw in bulk record creation endpoints. The application fails to verify individual employee access when creating records for multiple employees simultaneously. An authenticated user with...

CVE-2026-126314 Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

CVE-2026-126314 Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

PT-2026-146645

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside...

EUVD-2026-102493

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

CVE-2026-111349

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the createcustomer mutation to insert...

EUVD-2026-98058

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667

Frappe ERPNext versions before 15.111.0 and 16.x before 16.22.0 are vulnerable to a privilege escalation vulnerability. The root cause is a record-creation endpoint that accepts the record type from the request and inserts the data with permission checks disabled . An authenticated user, even wit...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109667 Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation

Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role,...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109645

Frappe ERPNext versions prior to 15.119.0 and 16.x before 16.31.0 are vulnerable to a missing authorization flaw (CWE-862). Certain endpoints fail to enforce proper permission checks, allowing authenticated attackers with low privileges to bypass role-based access restrictions. Exploiting this vu...

CVE-2026-109645 Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization

Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their permitted role,...

CVE-2026-109641

Frappe ERPNext versions before 15.110.0 and 16.x before 16.21.0 are susceptible to a missing authorization vulnerability (CWE-862). Specific endpoints fail to enforce proper authorization checks, allowing unauthenticated remote attackers to call these endpoints to create records and enumerate ava...

CVE-2026-109641 Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when an administrator h...