The flaw is a broken access control in the File list and report queries of the Frappe framework. It allows an authenticated user to request the file list or report views and retrieve metadata for private files that the user is not authorized to view. The disclosed data can include file names, paths, creation dates and other sensitive information, potentially aiding further reconnaissance or exploitation. The weakness is classified as CWE‑200.

The vulnerability affects the Frappe framework, versions earlier than 15.121.1 and those before 16.35.0. Affected products are identified by the CNA vendor product pair when using the Frappe framework.

With a CVSS score of 5.3, the risk is moderate. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that there is currently no known widespread exploitation. The likely attack vector requires the attacker to be an authenticated user; an attacker logs into a valid account and then submits file list or report queries. Once authenticated, the attacker can retrieve private file metadata that should otherwise be restricted.