CVE-2026-126315

Name of the Vulnerable Software and Affected Versions Frappe HRMS versions 16.14.0 through 16.20.0

Description Certain HR transactions send product usage events that bypass the site telemetry setting. This results in the transmission of sensitive information, such as leave type names, claimed amounts, and appraisal scores, even when telemetry is disabled. An attacker capable of monitoring telemetry traffic can access this data without requiring authentication.

Recommendations Update to version 16.20.1.