CVE-2026-126316

LOW 2.2

Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL

CVSS Score

2.2

EPSS Score

0.0%

EPSS Percentile

0th

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

CWE	CWE-598
Vendor	frappe
Product	hrms
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for frappe hrms

Be the first to know when new low vulnerabilities affecting frappe hrms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Affected Versions

frappe / hrms

16.0.0 < 16.20.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj vulncheck.com: https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url

Credits

Darshan060224 deepeshgarg007