CVE-2026-126315
Received Received - Intake

Frappe HRMS Telemetry Data Exposure in Version 16.14.0

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126315
EUVD
EUVD-2026-125205

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
frappe hrms to 16.20.1 (exc)
frappe hrms From 16.14.0 (inc) to 16.19.x (inc)
frappe hrms From 16.14.0 (inc) to 16.20.0 (inc)
frappe hrms 16.20.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Frappe HRMS versions 16.14.0 to 16.20.0 have a flaw where telemetry settings are ignored during HR transactions. This causes sensitive data like leave types, claimed amounts, and appraisal scores to be sent automatically without user consent or telemetry enabled.

Detection Guidance

To detect this vulnerability, monitor network traffic for outbound connections from Frappe HRMS instances to telemetry endpoints. Check for unexpected transmission of HR data like leave types, amounts, or appraisal scores when telemetry is disabled. Use packet capture tools like tcpdump or Wireshark to inspect traffic from HRMS servers.

Impact Analysis

This vulnerability exposes private HR data to unauthorized parties, violating privacy. It occurs without user interaction during normal use, potentially leaking sensitive information like leave details or appraisal scores even when telemetry is disabled.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized transmission of personal and sensitive HR data. It breaches privacy expectations and consent requirements, posing compliance risks for organizations handling protected health or employee information.

Mitigation Strategies

Immediately upgrade Frappe HRMS to version 16.20.1 or later to patch the telemetry bypass. Verify the upgrade by checking the version number in the application. Disable telemetry temporarily if an upgrade is not immediately possible, but note this may affect functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...