CVE-2025-30214 — Frappe vulnerable to information disclosure leading to account takeover

CVE-2025-30214

Frappe vulnerable to information disclosure leading to account takeover PUBLISHED

Description (CNA)

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

Affected (CNA)

Vendor / product	Versions
frappe / frappe	affected < 14.89.0; affected >= 15.0.0, < 15.51.0

CWE

CWE-200, CWE-287

References

https://github.com/frappe/frappe/security/advisories/GHSA-qrv3-jc3h-f3m6

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.