This vulnerability in the Frappe framework allows an attacker to execute the 'relink' and 'set_email_password' endpoints without proper permission checks. The lack of authentication permits an unauthenticated or low‑privileged user to modify email credentials or re‑associate accounts, leading to potential compromise of user accounts, data exfiltration, or service disruption. The weakness correlates with CWE‑862, indicating missing access control.

The affected product is the Frappe framework, specifically versions earlier than 15.107.0 for the 15.x series and earlier than 16.17.0 for the 16.x series. Administrators should verify which major release they are running and the patch level to confirm exposure.

The CVSS score of 6.9 indicates high severity. The EPSS score of less than 1% suggests a low probability of exploitation but the CVE is not listed in CISA KEV. Attackers could exploit the flaw via HTTP requests to the vulnerable endpoints if they can discover them, likely through fuzzing or known integration points. Due to the absence of authentication, the vulnerability has wide‑ranging impact across all users of the affected installations.