Deepeshgarg007

Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record type that employees can create. Authenticated users holding only the Employee role can create or change draft records for another employee, or for a company they do not belong to.

Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can create records for employees outside their user-permission scope, including other companies' employees.

تقوم بعض معاملات الموارد البشرية بإرسال أحداث استخدام المنتج التي تتجاوز إعدادات القياس عن بُعد للموقع. يؤدي ذلك إلى نقل معلومات حساسة، مثل أسماء أنواع الإجازات، والمبالغ المطالب بها، ودرجات التقييم، حتى عند تعطيل القياس عن بُعد. يمكن للمهاجم القادر على مراقبة حركة مرور القياس عن بُعد الوصول إلى هذه البيانات دون الحاجة إلى مصادقة.

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can query the affected endpoint to list every company on the site along with its default currency.