PT-2026-146647

CVE-2026-126316

·

Published

2026-11-13

·

Updated

2026-11-13

Description by

CVSS 3.1
2.2
Low
MetricsAV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.
Exploitability
Fix
Researchers
Vendors
Affected products
Weakness enumeration
CWE-598: Use of GET Request Method With Sensitive Query Strings
Related identifiers
CVE-2026-126316
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com