CVE Feed

    Dashboard / CVE / CVE-2023-54411

    CVE-2023-54411

    Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

    Published:Oct 12, 2026
    Last Modified:Oct 15, 2026
    EPS:Oct 12, 2026
    EPSS Score:0.00264
    CVSS Score:5.9

    Affected Products

    Vendor
    Frappe
    Product
    Frappe

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-119145 (CVSS 9.4) — Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-up…
    CVE-2026-119144 (CVSS 8.7) — Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerabili…
    CVE-2026-114664 (CVSS 7.1) — Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.…
    CVE-2026-111388 (CVSS 5.3) — Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist f…
    CVE-2026-55823 (CVSS 8.7) — Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview compo…
    CVE-2026-66057 (CVSS 5.1) — Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an …
    CVE-2026-109603 (CVSS 4.8) — Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-…
    CVE-2026-109602 (CVSS 5.1) — Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboa…
    CVE-2026-109601 (CVSS 7.1) — Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the …
    CVE-2026-109600 (CVSS 6.9) — Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled bef…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High