CVE-2023-54411

MEDIUMCVSS 5.9

Description

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

Timeline

Published:October 12th, 2026 11:17 PM

Last modified:October 15th, 2026 3:17 PM

CVSS Scoring

CVSS v3: 5.9 (MEDIUM)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-290

References & Reports

Advisories, patches, and third-party reports

https://github.com/frappe/frappe/security/advisories/GHSA-7xv4-ggpj-g48q
https://www.vulncheck.com/advisories/frappe-before-13.32.0-weak-authentication-via-print-view-key

Source: NIST NVD · Data may lag official sources by up to one minute