CVE-2026-126315

EUVD-2026-125205
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46.75%
Common Weakness Enumeration
References
https://github.com/frappe/hrms/security/advisories/GHSA-26gj-rr4j-3hgc
https://www.vulncheck.com/advisories/frappe-hrms-16.14.0-before-16.20.1-telemetry-setting-bypass-information-exposure