CVE-2026-126316

EUVD-2026-125204
Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
2.2 LOW
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.4%
Common Weakness Enumeration
References
https://github.com/frappe/hrms/security/advisories/GHSA-hphm-4mc5-m7gj
https://www.vulncheck.com/advisories/frappe-hrms-16.0.0-before-16.20.1-subscription-key-exposure-via-request-url