An improper privilege management flaw exists in Frappe versions before 14.81.4 and 15.x before 15.41.0. The vulnerability involves a specific document action that, when performed by an authenticated user with the Website User role, can be combined with other steps to gain System Manager privileges. This escalation allows an attacker to perform administrative actions within the Frappe application, threatening the confidentiality, integrity, and availability of the system.

Affected systems are installations running Frappe before version 14.81.4 and any 15.x release prior to 15.41.0. The flaw resides in the document handling module that incorrectly authorizes the action, making users with the Website User role able to trigger the vulnerability.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with at least the Website User role, so the attack vector is likely internal or based on compromised credentials. Once the document action is exploited, the attacker can elevate privileges to System Manager, giving full administrative control. Prompt remediation is necessary due to the high impact.