Frappe framework versions prior to 13.32.0 contain an authentication flaw that allows remote actors to generate a valid print view key. The key can be derived from data exposed by other whitelisted API endpoints, enabling attackers to access protected documents without proper authorization. This weakness is classified as CWE‑290, improper authentication.

Affected products include the Frappe framework from its inception up to, but excluding, version 13.32.0. All deployments of Frappe running any earlier release are vulnerable, regardless of custom configuration, because the vulnerability resides in the core framework.

The CVSS score of 8.2 indicates high severity, but the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, meaning no confirmed active exploitation is recorded yet, yet the attack path is simple: a remote attacker can request data from whitelisted API endpoints, compute the print view key, and then view documents. The lack of additional validation or access control on the print view endpoint makes exploitation straightforward once the key is derivable.