An inspection of Frappe reveals a missing authorization check on the endpoint that resets onboarding tours. Any authenticated user may trigger the reset process for all users, allowing unauthorized alteration of user onboarding settings. This privilege escalation flaw lets an attacker remove custom onboarding workflows from the system, reducing the effectiveness of user training and potentially revealing sensitive system usage patterns.

The vulnerability affects the Frappe full‑stack web application framework. The issue exists in all versions prior to 15.107.2 of Frappe 15 and prior to 16.17.4 of Frappe 16, meaning that systems running any earlier releases are impacted.

The CVSS score of 5.3 indicates a moderate impact, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. It is not listed in the CISA KEV catalog. Because the flaw requires an authenticated user, the likely attack vector is that an attacker already possessing valid credentials can lever the reset functionality to modify onboarding settings across the system. The documented exploitability assumes the attacker can reach the reset endpoint, which is accessible to all authenticated sessions.