CVE-2026-126316 · Package
NO FIX YET · SEE WHAT TO DO
Frappe HRMS from 16.0.0 before 16.20.1 sends the site's subscription key in the query string of outbound status requests. Anyone who can read proxy, server or monitoring logs on the request path can recover the key from recorded URLs.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Frappe HRMS from 16.0.0 before 16.20.1 are exposed, since the subscription key is sent in the URL of outbound status requests. Exposure requires someone who can read logs along the request path, such as a proxy, server or monitoring system. Teams on other versions or without a subscription key can skip it.
Not affected if no-subscription-key, version-outside-range
Who cares frappe, frappe-hrms, self-hosted
bench version or the hrms entry in the app list.16.20.1 or later.Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.