Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Frappe HRMS may send employee data even when disabled

CVE-2026-126315 · published 1 day ago
Summary

Versions 16.14.0 through 16.20.0 of Frappe HRMS transmit usage information about HR actions, such as leave types, claim amounts, and appraisal scores, even when the telemetry feature is turned off. This can expose internal staffing details without any user interaction. Upgrade to version 16.20.1 or later, or verify that network traffic to the telemetry service is blocked, to stop the unintended data sharing.

What to do
  • Update frappe hrms to version 16.20.1 or later.
Affected software
VendorProductAffected versions
frappe hrms < 16.20.1
Original advisory text
Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-359Exposure of Private Personal Information to an Unauthorized Actor
Timeline
Published13 Nov 2026
Updated15 Nov 2026
First seen13 Nov 2026
Sources
CVE-2026-126315 · NVD
CVE-2026-126315 · MITRE
CVE-2026-126315 · OSV
GHSA-26gj-rr4j-3hgc · GHSA
Track software like this
Free during beta