---
id: "CVE-2026-126316"
page: "https://infrastack.ai/live/CVE-2026-126316"
kind: "vulnerability"
aliases: ["CVE-2026-126316"]
title: "Frappe HRMS: subscription key leaks into logged request URLs"
severity: "low"
cvss: 2.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frappe", "frappe-hrms", "package", "self-hosted"]
not_affected_if: ["no-subscription-key", "version-outside-range"]
published_at: "2026-11-13T10:17:37+00:00"
first_seen_at: "2026-11-13T10:47:16+00:00"
updated_at: "2026-11-13T10:59:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126316", "first_seen_at": "2026-11-13T10:47:16+00:00"}]
exploit_sources: []
---

# Frappe HRMS: subscription key leaks into logged request URLs

Link for people: https://infrastack.ai/live/CVE-2026-126316 (this .md is for agents)

Frappe HRMS from 16.0.0 before 16.20.1 sends the site's subscription key in the query string of outbound status requests. Anyone who can read proxy, server or monitoring logs on the request path can recover the key from recorded URLs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed HRMS version: `bench version` or the `hrms` entry in the app list.
- Look for the subscription key in proxy or monitoring logs that record outbound request URLs.

## Fix

- Frappe HRMS: move to `16.20.1` or later.

## Timeline

- 2026-11-13T10:47:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126316

## Documents

- [advisory] Vendor advisory: github.com https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url

## From the sources

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_