p PatchFirst

CVE-2025-30214

CVE-2025-30214 · Frappe vulnerable to information disclosure leading to account takeover

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

CVSS 8.0 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • frappe

    Versions
    • < 14.89.0: Affected
    • >= 15.0.0, < 15.51.0: Affected

    No fix published

  • frappe PyPI

    Versions
    • 0.0.1
    Affected ranges
    • ECOSYSTEM: < 14.89.0

    Update to 14.89.0

  • frappe PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 15.0.0, < 15.51.0

    Update to 15.51.0

  • frappe PyPI

    Versions
    • 0.0.1
    Affected ranges
    • ECOSYSTEM: < 14.89.0 ∪ ≥ 15.0.0, < 15.51.0

    Update to 14.89.0; Update to 15.51.0

Original sources

Check your server →