Frappe Framework fails to enforce the restrict_ip allowlist for non‑session authentication methods, including API key, OAuth, and header‑based authentication. Valid credentials of these types therefore grant an attacker the ability to authenticate from any IP address, bypassing network‑based access controls and potentially enabling privileged actions within the application. The impact is a loss of confidentiality, integrity, and adherence to the organization’s network segmentation policies.

The vulnerability affects all releases of Frappe Framework before version 15.120.0 and before 16.33.0. Administrators should verify whether their installed version falls into these ranges and consider upgrading as part of remediation.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score of 0.00174 (<1%) indicates a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting lower likelihood of widespread exploitation. However, the attack can be carried out remotely by an attacker who already possesses valid API key, OAuth token, or header‑based authentication credentials, enabling them to bypass IP‑based restrictions. Successful exploitation could allow the attacker to perform actions with the privileges associated with the compromised credentials.