frappe/frappe · Security
Frappe vulnerable to information disclosure leading to account takeover
- GHSA ID
- GHSA-qrv3-jc3h-f3m6
- CVE ID
- CVE-2025-30214
- Severity
- high
- Published
- Updated
- CVSS v4
- 8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
Description
Impact
Making crafted requests could lead to information disclosure that could further lead to account takeover.
Workarounds
There's no workaround to fix this without upgrading.
Credits
Thanks to Thanh of Calif.io for reporting the issue
CWEs
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor