A missing validation in the submit_discussion endpoint of the Frappe web framework allows an attacker to submit or read discussions without proper authorization, exploiting an IDOR weakness identified by CWE‑284 and CWE‑285. By manipulating request parameters, the attacker can gain access to resources reserved for other users or to create new discussions that they should not be able to create. The impact is a breach of confidentiality and potential integrity of discussion data, enabling unauthorized disclosure and manipulation of organizational communication.

The vulnerability applies to the Frappe framework, specifically all releases prior to 15.107.0 and 16.17.0. Administrators running versions 15.x below 15.107.0 or 16.x below 16.17.0 should consider themselves at risk and evaluate their deployment for the presence of the submit_discussion endpoint.

The CVSS score of 6.9 reflects a moderate severity, and the EPSS score of less than 1% suggests a very low probability of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Nonetheless, because the flaw is an IDOR, an attacker with knowledge of discussion identifiers can bypass security controls, potentially compromising sensitive information. Risk is heightened if users have broad access rights or if the submit_discussion endpoint is exposed to external networks.