The vulnerability arises because the /restore and /bulk_restore endpoints in Frappe bypass document‑level permission checks. An attacker who is authenticated can trigger these endpoints to recover documents that the user is not entitled to restore, effectively giving them the ability to resurrect deleted data and potentially alter the system state. Because the attack does not require any other privileges, the flaw can result in unauthorized data restoration and privilege escalation within the application. This weakness is classified as CWE‑862, an unprotected access control.

The flaw affects the Frappe framework, specifically versions older than 15.110.0 and 16.20.0. Users running 15.x builds earlier than 15.110.0 or 16.x builds earlier than 16.20.0 are susceptible to the issue. The vulnerability has been addressed in later releases of the respective branches.

The CVSS score is 7.1, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Lacking a formal EPSS rating, the probability of exploitation cannot be quantified, but the flaw is present in unpatched installations that expose the restore endpoints to authenticated clients. The likely attack vector is internal or network‑proxied users who can send HTTP requests to the vulnerable endpoints; no special privileges beyond authentication are required. Because the missing permission checks apply to all authenticated users, any user with network access to the application could employ the flaw to restore data without authorization.