Frappe Framework: Weak authentication in print view access
Summary
Frappe framework versions before 13.32.0 use weak authentication for print view access. The print view key can be derived from data exposed by other whitelisted API endpoints, so an attacker can generate a valid key and view documents without the required permissions. The attack requires network access to the instance and high attack complexity, but no login or user interaction.
Affected
- Frappe framework before 13.32.0
- Whether the 14.x, 15.x and 16.x branches are affected: Unknown.
Fixed in
- Frappe 13.32.0 (fix commit b0cbe399d0d652b0e175c8bf10160c0ff4eac974 per OSV)
- Fixed release for other branches: Unknown.
Workaround
- No workaround is documented in the sources.
- Restrict external access to the Frappe site and review which API endpoints are accessible without authentication (interim measure, not from the sources).
Exploitation
- Not listed as known exploited.
- EPSS 0.00264 (low exploitation probability).
- CISA SSVC: exploitation none, not automatable.
- A public proof of concept may exist; this is unverified.
Our recommendation
- Inventory all Frappe and ERPNext instances and their versions, including non-production copies.
- Upgrade affected installations to 13.32.0 or later, or to the fixed release for your branch.
- Limit exposure of internet-facing instances and review guest-accessible API endpoints.
- Review access logs for unusual print view requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-7xv4-ggpj-g48q github.com
- VulnCheck advisory: Frappe before 13.32.0 Weak Authentication via Print View Key www.vulncheck.com
- OSV: CVE-2023-54411 osv.dev
- Vulners VulnCheck enrichment: CVE-2023-54411 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:34.
Original description (NVD)
Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.