The vulnerability in Frappe allows any authenticated user to access private files by guessing the file path, leading to unauthorized disclosure of sensitive data. This flaw stems from a broken access control weakness (CWE‑284) that fails to enforce proper authorization checks on file retrieval. The ability to read arbitrary private files compromises confidentiality but does not alter the system state, so integrity and availability remain unaffected.

The issue affects installations of the Frappe framework before version 16.17.4. Users on earlier releases who have any level of authenticated access, including regular users, can exploit the flaw. The vulnerability is limited to the Frappe product and does not extend to other components or third‑party integrations.

The CVSS score of 5.3 indicates moderate risk, while the EPSS value of less than 1% suggests a low likelihood that the vulnerability will be actively exploited. It is not listed in CISA KEV. The likely attack path is through an authenticated web session, where an attacker guesses or enumerates file URLs to read protected data. No specific code execution or privilege escalation is required.