Frappe print view key weakness allows unauthenticated document access (CVE-2023-54411)

What happened

Frappe framework releases before 13.32.0 authenticate access to the print view with a key that can be derived from data exposed by other whitelisted API endpoints. An unauthenticated attacker who can reach the service over the network can generate a valid key and view documents without the permissions normally required. No user interaction or account is needed; the attack is rated high complexity because the key must be derived.

The CVE record classifies the weakness as CWE-290, authentication bypass by spoofing, and gives a CVSS 4.0 score of 8.2 (high). Impact is limited to confidentiality: document contents can be read, with no stated impact on integrity or availability. The CVE record and references do not state that exploitation has occurred and do not list a public exploit disclosure.

Who is affected

Affected is the Frappe framework: any release before 13.32.0. The weakness is in the framework itself, so the test is whether the installed Frappe version is below 13.32.0. Because the attack is reachable over the network, instances exposed beyond trusted users or networks are the most immediately at risk.

What to do now

1. Upgrade Frappe to 13.32.0. This is the fixed release named in the CVE record and addresses the weak print view authentication.
2. Prioritise instances where the Frappe application or its print view is reachable from the internet or from less trusted network segments.
3. If an immediate upgrade is not possible, restrict network access to affected instances and monitor for unexpected print view use until the upgrade can be scheduled.

How to detect it

Review access logs for print view requests from external or unexpected addresses, especially requests for documents the requesting context should not normally access. The referenced sources do not provide vendor-issued indicators of compromise.

Beyond the patch

The follow-up is visibility: an unauthenticated, network-reachable weakness in a core business application is an exposure problem, not just a patch cycle. Virtual CISO Services (vCISO) helps maintain an outside-in view of services like this so the next exposed print view is found before an attacker does. If Frappe is supplied by a partner or runs in a subsidiary, Supply Chain Defense & Third-Party Risk helps track whether their patching cadence meets your exposure window.