Frappe versions prior to 13.22.0 contain an improper authorization flaw that allows any authenticated user to invoke the rename function on documents without having modify rights. This missing permission check is a CWE‑285 weakness and grants the attacker the ability to alter record identifiers, potentially leading to incorrect data references or abuse of the system’s logic.

All installations of the Frappe platform running a version earlier than 13.22.0 are vulnerable. The vulnerability applies to the core document rename functionality across the application’s modules and can affect any document type that the user can view but not edit.

The CVSS score of 5.3 indicates a moderate impact with authenticated users able to perform the exploit. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog. Attackers must first authenticate to the system and then use the rename endpoint; no external access vector is required. Given the moderate severity and lack of public exploitation data, the risk is considered manageable but corrective action is recommended.