CVE-2023-54411CWE-290

CVE-2023-54411

Medium · published October 13, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
17.2
In the wild
Unconfirmed
What it is

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00264 · 17.2th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2026-10-13T03:17Z
References (2)
https://github.com/frappe/frappe/security/advisories/GHSA-7xv4-ggpj-g48q · [email protected]https://www.vulncheck.com/advisories/frappe-before-13.32.0-weak-authentication-via-print-view-key · [email protected]
EPSS history
Timeline
  • 14 OCT 03:20Z
    EPSS moved — → 0%
    epss
  • 12 OCT 22:21Z
    Frappe before 13.32.0 Weak Authentication via Print View Key
    cvelistv5
  • 12 OCT 22:21Z
    Frappe before 13.32.0 Weak Authentication via Print View Key
    cvelistv5