CVE-2026-126315: Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe HRMSto a version that resolves this vulnerability.Fixed in 16.20.1
Event History
Frequently Asked Questions
Which deployments are affected?
Frappe HRMS versions 16.14.0 before 16.20.1 are affected. Sites that have disabled telemetry are still affected because certain HR transaction events are sent without honoring that setting.
What information can be transmitted?
Affected usage events may include leave type names, claimed amounts, and appraisal scores. The exposure occurs during normal HRMS use and does not require user action.
Does exploitation require an attacker to authenticate or interact with users?
No. The provided vector indicates network access with low complexity, no privileges, and no user interaction, while the described behavior occurs automatically during normal use.
How can I determine whether data may already have been exposed?
Review whether the site ran an affected version and processed the relevant HR transactions while telemetry was disabled. The available information does not identify a complete list of affected transaction types or provide event-log indicators.