Frappe is a full-stack web application framework that, prior to releases 16.14.0 and 15.104.0, allows unrestricted access to any Doctype through its API. The vulnerability is classified as CWE-862 (Missing Function- or Role-Level Access Control) and permits an attacker to read the full contents of any document type, potentially revealing sensitive business or personal data.

All installations of the Frappe framework running any version earlier than 16.14.0 or 15.104.0 are affected. No restriction on deployment environment is mentioned; the issue applies wherever the default API endpoints are accessible.

The CVSS score of 6.9 indicates moderate severity; the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The description does not state whether authentication is required, so it is uncertain whether the flaw can be exercised without valid credentials. The most likely attack vector is the web API exposed by the application, requiring network access to the Frappe instance. The vulnerability is not listed in CISA’s KEV catalog, and no public exploit is known.