The vulnerability allows a user to share a document with a permission level that the user does not possess, effectively bypassing the access control enforced by the application. As a result, the user may gain unauthorized access to documents that contain sensitive information. This flaw is classified as an improper access control weakness (CWE‑284) and a resource access control issue (CWE‑602).

The issue affects the Frappe web application framework. Versions earlier than 15.98.0, and versions earlier than 14.100.0, are vulnerable. The fix is included in Frappe 15.98.0 and 14.100.0 and later releases.

The CVSS score of 7.1 indicates high severity, but the EPSS score of less than 1 % suggests the likelihood of exploitation is low in the short term. This vulnerability is not listed in the CISA catalog of known exploited vulnerabilities, implying no confirmed high‑profile exploitation. Attackers would need to be authenticated users of the application. Exploitation is achieved by selecting a higher permission level when sharing a document, which the system does not validate against the user’s own privileges. Monitoring for abnormal document sharing permissions is advised, but the primary mitigation is to apply the vendor’s patch.