Frappe 14.x before 14.45.0 logs local variable values during error tracebacks, exposing sensitive secrets such as usernames, passwords, and cryptographic keys to anyone who can view the error logs. This flaw is a direct information‑disclosure vulnerability that allows attackers to retrieve plaintext secrets from traceback data.

The affected system is the Frappe application framework, specifically releases in the 14.x series prior to 14.45.0. Users running any of these versions are vulnerable, regardless of the environment in which the application operates.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score is not available, but the CVE is not listed in the CISA KEV catalog, suggesting no publicly confirmed exploit at the time of this analysis. The vulnerability can be exploited by an attacker who has permission to read the application's error logs, a condition that is common in many installations where logs are accessible to regular users or services. Once accessed, the attacker can extract the exposed secrets without additional exploitation steps.