{"id":"CVE-2026-126315","kind":"vulnerability","aliases":["CVE-2026-126315"],"related":[],"title":"Frappe HRMS: telemetry sends HR data even when disabled","description":"Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.","summary":"Frappe HRMS versions 16.14.0 before 16.20.1 send product usage events on certain HR transactions without checking the site's telemetry setting. Values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is turned off.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe-hrms","hr-data","package","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed `frappe-hrms` version in the bench apps list or the app's `pyproject.toml`.\n- Confirm whether telemetry is disabled in the site settings and whether HR leave, expense claim or appraisal transactions are used.","fix":"- Move Frappe HRMS to `16.20.1` or later.","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:48:11+00:00","updated_at":"2026-11-13T10:48:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:48:11Z","model":"claude-haiku-5-5","output":{"fix":"- Move Frappe HRMS to `16.20.1` or later.","reach":"internet","title":"Frappe HRMS: telemetry sends HR data even when disabled","impact":"medium","summary":"Frappe HRMS versions 16.14.0 before 16.20.1 send product usage events on certain HR transactions without checking the site's telemetry setting. Values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is turned off.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe-hrms","self-hosted","hr-data"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"HR data leaves the server to a third party without consent","analyst_note":"Fixed version 16.20.1 comes from the NVD description; confirm the product range in the vendor advisory.\n\n","how_to_check":"- Check the installed `frappe-hrms` version in the bench apps list or the app's `pyproject.toml`.\n- Confirm whether telemetry is disabled in the site settings and whether HR leave, expense claim or appraisal transactions are used.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range"],"who_is_affected":"Sites running Frappe HRMS from 16.14.0 up to but not including 16.20.1 are exposed, whether or not telemetry is turned off in the site settings. The data leaves during normal HR transactions with no user action, so teams running self-hosted HRMS should check their version. Sites on earlier or later releases are not listed as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000754,"input_tokens":4607,"output_tokens":586,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126315':12A,15A '-2026':11A,14A '16.14.0':29B,67C '16.20.1':31B,69C 'action':99C 'amount':54B,107C 'apprais':56B,109C 'certain':37B,75C 'check':41B,79C 'claim':53B,106C 'cve':10A,13A 'data':6A,21B 'detail':90C 'disabl':9A,117C 'even':7A,60B,113C 'event':35B,73C,87C 'frapp':1A,17B,26B,65C 'frappe-hrm':16B 'host':25B 'hr':5A,20B,38B,76C 'hr-data':19B 'hrms':2A,18B,27B,66C 'includ':88C 'leav':50B,103C 'name':52B,105C 'need':92C 'normal':94C 'packag':22B 'product':33B,71C 'score':57B,110C 'self':24B 'self-host':23B 'send':4A,32B,70C 'set':46B,84C 'site':43B,81C 'telemetri':3A,45B,62B,83C,115C 'transact':39B,77C 'transmit':59B,112C 'turn':64B 'type':51B,104C 'usag':34B,72C 'use':95C 'user':98C 'valu':47B,100C 'version':28B 'without':40B,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe HRMS from 16.14.0 up to but not including 16.20.1 are exposed, whether or not telemetry is turned off in the site settings. The data leaves during normal HR transactions with no user action, so teams running self-hosted HRMS should check their version. Sites on earlier or later releases are not listed as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","frappehrms","hrdata","package","selfhosted"],"campaign_type":null,"search_a":"'-126315':12A,15A '-2026':11A,14A 'cve':10A,13A 'data':6A 'disabl':9A 'even':7A 'frapp':1A 'hr':5A 'hrms':2A 'send':4A 'telemetri':3A","search_b":"'16.14.0':29B '16.20.1':31B 'amount':54B 'apprais':56B 'certain':37B 'check':41B 'claim':53B 'data':21B 'even':60B 'event':35B 'frapp':17B,26B 'frappe-hrm':16B 'host':25B 'hr':20B,38B 'hr-data':19B 'hrms':18B,27B 'leav':50B 'name':52B 'packag':22B 'product':33B 'score':57B 'self':24B 'self-host':23B 'send':32B 'set':46B 'site':43B 'telemetri':45B,62B 'transact':39B 'transmit':59B 'turn':64B 'type':51B 'usag':34B 'valu':47B 'version':28B 'without':40B","search_c":"'16.14.0':67C '16.20.1':69C 'action':99C 'amount':107C 'apprais':109C 'certain':75C 'check':79C 'claim':106C 'detail':90C 'disabl':117C 'even':113C 'event':73C,87C 'frapp':65C 'hr':76C 'hrms':66C 'includ':88C 'leav':103C 'name':105C 'need':92C 'normal':94C 'product':71C 'score':110C 'send':70C 'set':84C 'site':81C 'telemetri':83C,115C 'transact':77C 'transmit':112C 'type':104C 'usag':72C 'use':95C 'user':98C 'valu':100C 'without':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:08:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126315","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144961,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-26gj-rr4j-3hgc","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:08:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144962,"url":"https://www.vulncheck.com/advisories/frappe-hrms-16.14.0-before-16.20.1-telemetry-setting-bypass-information-exposure","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}