{"id":"CVE-2026-126316","kind":"vulnerability","aliases":["CVE-2026-126316"],"related":[],"title":"Frappe HRMS: subscription key leaks into logged request URLs","description":"Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.","summary":"Frappe HRMS from 16.0.0 before 16.20.1 sends the site's subscription key in the query string of outbound status requests. Anyone who can read proxy, server or monitoring logs on the request path can recover the key from recorded URLs.","severity":"low","cvss":2.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frappe","frappe-hrms","package","self-hosted"],"not_affected_if":["no-subscription-key","version-outside-range"],"how_to_check":"- Check the installed HRMS version: `bench version` or the `hrms` entry in the app list.\n- Look for the subscription key in proxy or monitoring logs that record outbound request URLs.","fix":"- Frappe HRMS: move to `16.20.1` or later.","status":"open","published_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","triaged_at":"2026-11-13T10:59:03+00:00","updated_at":"2026-11-13T10:59:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:59:03Z","model":"claude-haiku-5-5","output":{"fix":"- Frappe HRMS: move to `16.20.1` or later.","reach":"local","title":"Frappe HRMS: subscription key leaks into logged request URLs","impact":"low","summary":"Frappe HRMS from 16.0.0 before 16.20.1 sends the site's subscription key in the query string of outbound status requests. Anyone who can read proxy, server or monitoring logs on the request path can recover the key from recorded URLs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["frappe","frappe-hrms","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Subscription key readable from logs, enabling misuse of the site's subscription","analyst_note":"Product ranges and the vendor advisory on github.com were not read in detail; confirm the fixed version and whether the key is sent on every request.","how_to_check":"- Check the installed HRMS version: `bench version` or the `hrms` entry in the app list.\n- Look for the subscription key in proxy or monitoring logs that record outbound request URLs.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-outside-range","no-subscription-key"],"who_is_affected":"Sites running Frappe HRMS from 16.0.0 before 16.20.1 are exposed, since the subscription key is sent in the URL of outbound status requests. Exposure requires someone who can read logs along the request path, such as a proxy, server or monitoring system. Teams on other versions or without a subscription key can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000748,"input_tokens":4597,"output_tokens":576,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-126316':12A,15A '-2026':11A,14A '16.0.0':27B,67C '16.20.1':29B,69C 'access':91C 'along':98C 'anyon':44B 'attack':89C 'contain':70C 'cve':10A,13A 'exposur':73C 'frapp':1A,16B,18B,24B,64C 'frappe-hrm':17B 'host':23B 'hrms':2A,19B,25B,65C 'inform':72C 'key':4A,35B,60B,79C,108C 'leak':5A 'log':7A,52B,97C 'monitor':51B,96C 'outbound':41B,85C 'packag':20B 'path':56B,101C 'place':76C 'proxi':48B,93C 'queri':38B,82C 'read':47B 'record':62B,110C 'recov':58B,103C 'request':8A,43B,55B,88C,100C 'self':22B 'self-host':21B 'send':30B 'server':49B,94C 'site':32B,105C 'status':42B,87C 'string':39B,83C 'subscript':3A,34B,78C,86C,107C 'url':9A,63B,111C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Sites running Frappe HRMS from 16.0.0 before 16.20.1 are exposed, since the subscription key is sent in the URL of outbound status requests. Exposure requires someone who can read logs along the request path, such as a proxy, server or monitoring system. Teams on other versions or without a subscription key can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frappe","frappehrms","low","package","selfhosted"],"campaign_type":null,"search_a":"'-126316':12A,15A '-2026':11A,14A 'cve':10A,13A 'frapp':1A 'hrms':2A 'key':4A 'leak':5A 'log':7A 'request':8A 'subscript':3A 'url':9A","search_b":"'16.0.0':27B '16.20.1':29B 'anyon':44B 'frapp':16B,18B,24B 'frappe-hrm':17B 'host':23B 'hrms':19B,25B 'key':35B,60B 'log':52B 'monitor':51B 'outbound':41B 'packag':20B 'path':56B 'proxi':48B 'queri':38B 'read':47B 'record':62B 'recov':58B 'request':43B,55B 'self':22B 'self-host':21B 'send':30B 'server':49B 'site':32B 'status':42B 'string':39B 'subscript':34B 'url':63B","search_c":"'16.0.0':67C '16.20.1':69C 'access':91C 'along':98C 'attack':89C 'contain':70C 'exposur':73C 'frapp':64C 'hrms':65C 'inform':72C 'key':79C,108C 'log':97C 'monitor':96C 'outbound':85C 'path':101C 'place':76C 'proxi':93C 'queri':82C 'record':110C 'recov':103C 'request':88C,100C 'server':94C 'site':105C 'status':87C 'string':83C 'subscript':78C,86C,107C 'url':111C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T07:08:13+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126316","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126316","severity":null,"published_at":"2026-11-13T10:17:37+00:00","modified_at":"2026-11-13T10:17:37+00:00","first_seen_at":"2026-11-13T10:47:16+00:00","fetched_at":"2026-11-13T10:47:16+00:00","note":null}],"documents":[{"id":144963,"url":"https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T07:08:13+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":144964,"url":"https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}