CVE-2023-54411

MediumCVSS 5.9/10Last modified Oct 15, 2026

Description

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published
Oct 12, 2026
Last modified
Oct 15, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-544126.5Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows anCVE-2023-544136.1WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated CVE-2023-54437.5Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. TCVE-2023-54448.0A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to succesCVE-2023-54455.4An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL pCVE-2023-54475.5Missing lock check in SynHsaService may create a use-after-free condition which causes abnormal termination of the service, resulting in denCVE-2023-54488.8The WP Register Profile With Shortcode plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.CVE-2023-54493.3A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a moniCVE-2023-54507.8An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of pCVE-2023-54516.1Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downCVE-2023-54525.4Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.CVE-2023-54547.5The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticate