Frappe HRMS versions 16.14.0 up to but not including 16.20.1 send product usage events containing HR transaction details even when a site has turned telemetry off.
What Is It
CVE-2026-126315 is an information exposure flaw in Frappe HRMS. VulnCheck disclosed it and assigned it CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). Affected versions send product usage events on certain HR transactions without checking the site's telemetry setting. Some of those events also carry more detail than they need.
According to the NVD description, this happens during normal use with no user action. It sends values such as leave type names, claimed amounts and appraisal scores even when telemetry is disabled.
NVD received the record on 2026-11-13. Its status is "Received," so NVD has not yet analyzed it.
Why It Matters
HR systems hold sensitive employee data. According to the advisory description, this flaw can expose expense claim amounts and performance appraisal scores during normal use, without any specific action from users or administrators. Organizations that disabled telemetry for privacy or compliance reasons could reasonably have assumed this data stayed on site. On affected versions, that assumption may not have held.
VulnCheck rates the flaw CRITICAL:
- CVSS 3.1: 9.8 (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3
The CVSS 3.1 vector lists high integrity and availability impact. The CVSS 4.0 vector has not been published here, so its impact ratings can't be checked. The description only covers data exposure, so treat these scores with some caution until NVD analyzes the record.
This CVE is not in the CISA Known Exploited Vulnerabilities catalog. The supplied KEV data is empty, so nothing confirms active exploitation, and KEV sets no required action or due date.
What's Vulnerable
- Vendor: Frappe
- Product: HRMS
- Affected: 16.14.0 up to but not including 16.20.1
- Not affected: 16.20.1. Versions outside the affected range are listed as unaffected by default.
No CPE entries have been published yet.
Patch Status
Version 16.20.1 is listed as unaffected. Organizations running HRMS 16.14.0 through any release before 16.20.1 should upgrade to 16.20.1 or later. The GitHub advisory and the VulnCheck advisory below have the vendor's details.
Based on the published description, turning telemetry off is unlikely to protect affected versions, because the affected code paths do not check the setting. Upgrading to 16.20.1 or later is the recommended fix.