CVE-2026-126315

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126315
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126315.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126315
Aliases
  • GHSA-26gj-rr4j-3hgc
Published
2026-11-13T09:36:15Z
Modified
2026-11-14T10:30:44Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
Details

Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, claimed amounts and appraisal scores are transmitted even when telemetry is disabled.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-359"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126315.json"
}
References

Affected packages

Git / github.com/frappe/hrms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/hrms
Events
Introduced
6aa125b976469cb1c342afa3ef07d381c88677e0
Fixed
6f5ac249283f6fa1013fd5616f3d95f686ba7bb2
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "16.14.0"
                },
                {
                    "fixed": "16.20.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v16.*
v16.14.0
v16.15.0
v16.16.0
v16.17.0
v16.17.1
v16.18.0
v16.18.1
v16.19.0
v16.20.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126315.json"