CVE-2026-126316

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-126316
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126316.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-126316
Aliases
  • GHSA-hphm-4mc5-m7gj
Published
2026-11-13T09:36:14Z
Modified
2026-11-14T02:47:27Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL
Details

Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-598"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126316.json"
}
References

Affected packages

Git / github.com/frappe/hrms

Affected ranges

Type
GIT
Repo
https://github.com/frappe/hrms
Events
Introduced
19a835b7ca10132365a8707931d65381aa68a846
Fixed
6f5ac249283f6fa1013fd5616f3d95f686ba7bb2
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "16.0.0"
                },
                {
                    "fixed": "16.20.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.0.2
v16.1.0
v16.10.0
v16.10.1
v16.11.0
v16.12.0
v16.12.1
v16.12.2
v16.13.0
v16.14.0
v16.15.0
v16.16.0
v16.17.0
v16.17.1
v16.18.0
v16.18.1
v16.19.0
v16.2.0
v16.20.0
v16.3.0
v16.3.1
v16.4.0
v16.4.1
v16.4.2
v16.4.3
v16.4.4
v16.4.5
v16.4.6
v16.4.7
v16.4.8
v16.5.0
v16.5.1
v16.5.2
v16.5.3
v16.5.4
v16.6.0
v16.6.1
v16.7.0
v16.7.1
v16.8.0
v16.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126316.json"