CVE-2023-54411

5.9Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.9Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-290

Impact

Unauthenticated network attackers can read sensitive documents via the print view without proper permissions. They need network access to whitelisted API endpoints to derive the required print view access key.

Root cause

The print view authentication key can be calculated from data exposed by other whitelisted API endpoints, allowing key spoofing.

Affected systems

Frappe framework before version 13.32.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade Frappe framework to version 13.32.0 or later. If patching immediately is not possible, restrict or block external access to the print view endpoints and whitelisted APIs.

shell

$ bench update --apps frappe

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

References

Source: nvd.nist.gov/vuln/detail/CVE-2023-54411