CVE-2026-126315Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.

9.3 CRITICALNot in KEVNVD: Received

Last updated: 2026-11-13 10:17 UTC

OverviewCVSS details

9.3CRITICALCVSS 4.0

Score source: VulnCheck (CNA)
NVD status: Received
Published: Nov 13, 2026
Assigner: VulnCheck

Affected

hrms (frappe)

Versions: 16.14.0 before 16.20.1
Fixed in: 16.20.1

Exploitation

Public exploit: None listed
CISA KEV: Not listed
KEV due date: —

EPSS

No EPSS score yet.

CVSS 4.0 · VulnCheck (CNA)

9.3Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality impact: High
Integrity impact: High
Availability impact: High
Confidentiality (other systems): None
Integrity (other systems): None
Availability (other systems): None

CVSS 3.1 · VulnCheck (CNA)

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Received

Overview Affected Products References

Overview

Severity

Score	Severity	Version	Technologies Affected
9.3	CRITICAL	4.0VulnCheck (CNA)	Frappe Hrms
9.8	CRITICAL	3.1VulnCheck (CNA)	Frappe Hrms

Details

CVE ID: CVE-2026-126315
Status: Received
Assigner (CNA): VulnCheck
Published: Nov 13, 2026
Last modified: 2026-11-13 10:17 UTC
Weaknesses: CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-13 12:56 UTC.