CVE-2026-126316
Received Received - Intake

Frappe HRMS Information Exposure via Subscription Key in URLs

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126316
EUVD
EUVD-2026-125204

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frappe hrms From 16.0.0 (inc) to 16.20.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-598 The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information exposure issue in Frappe HRMS versions 16.0.0 to 16.20.0 where the subscription key is included in the query string of outbound subscription status requests. Attackers with access to logs or monitoring data can extract the key from recorded URLs.

Detection Guidance

Check web server or proxy logs for outbound subscription status requests containing 'subscription_key' or similar parameters in the URL query string. Use grep commands like 'grep subscription_key /var/log/nginx/access.log' or 'grep subscription_key /var/log/apache2/access.log' to search for exposed keys.

Impact Analysis

If exploited, attackers could recover the site's subscription key from logs or monitoring data. This could lead to unauthorized access or misuse of the subscription, though the severity is classified as low.

Mitigation Strategies

Upgrade Frappe HRMS to version 16.20.1 or later to patch the vulnerability. Review and sanitize logs to remove any recorded subscription keys. Ensure no sensitive keys are exposed in future requests by verifying the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126316. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...