CVE-2023-54411

Deferred Deferred - Pending Action

Frappe Framework Print View Authentication Bypass

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2023-54411

Affected Vendors & Products

Vendor	Product	Version / Range
frappe	frappe	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

Executive Summary

Frappe framework versions before 13.32.0 have a weak authentication mechanism for print view access. The print view key can be derived from data exposed by other whitelisted API endpoints, allowing attackers to generate a valid key without proper permissions and view documents through the print view.

Impact Analysis

Attackers could exploit this to access sensitive documents without authorization, potentially leading to data breaches or unauthorized disclosure of confidential information.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls.

Mitigation Strategies

Upgrade Frappe framework to version 13.32.0 or later to address the weak authentication in print view access.

Hi! I’m here to help you understand CVE-2023-54411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70