---
id: "CVE-2026-126315"
page: "https://infrastack.ai/live/CVE-2026-126315"
kind: "vulnerability"
aliases: ["CVE-2026-126315"]
title: "Frappe HRMS: telemetry sends HR data even when disabled"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frappe-hrms", "hr-data", "package", "self-hosted"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-13T10:17:37+00:00"
first_seen_at: "2026-11-13T10:47:16+00:00"
updated_at: "2026-11-13T10:48:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126315", "first_seen_at": "2026-11-13T10:47:16+00:00"}]
exploit_sources: []
---

# Frappe HRMS: telemetry sends HR data even when disabled

Link for people: https://infrastack.ai/live/CVE-2026-126315 (this .md is for agents)

Frappe HRMS versions 16.14.0 before 16.20.1 send product usage events on certain HR transactions without checking the site's telemetry setting. Values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is turned off.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `frappe-hrms` version in the bench apps list or the app's `pyproject.toml`.
- Confirm whether telemetry is disabled in the site settings and whether HR leave, expense claim or appraisal transactions are used.

## Fix

- Move Frappe HRMS to `16.20.1` or later.

## Timeline

- 2026-11-13T10:47:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126315

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-26gj-rr4j-3hgc
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-16.14.0-before-16.20.1-telemetry-setting-bypass-information-exposure

## From the sources

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_