CVE-2026-126315 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS versions 16.14.0 before 16.20.1 send product usage events on certain HR transactions without checking the site's telemetry setting. Values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is turned off.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Frappe HRMS from 16.14.0 up to but not including 16.20.1 are exposed, whether or not telemetry is turned off in the site settings. The data leaves during normal HR transactions with no user action, so teams running self-hosted HRMS should check their version. Sites on earlier or later releases are not listed as affected.
Not affected if version-outside-range
Who cares frappe-hrms, hr-data, self-hosted
frappe-hrms version in the bench apps list or the app's pyproject.toml.16.20.1 or later.Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.