In Frappe versions 16.31.0 and earlier, the endpoints for toggling a like and marking a note as seen do not verify that an authenticated user has read access to the target document or note. This omission allows a user who cannot normally view the resource to still interact with it, revealing the resource’s existence and altering its _liked_by metadata or its seen state. The vulnerability constitutes a missing authorization flaw (CWE‑862) that can be leveraged to influence application state and gain knowledge about protected resources.

The Frappe full‑stack web application framework, versions 16.31.0 and earlier, is affected. No fixed version has been released at this time.

The CVSS score of 5.3 places this issue in the moderate severity range. The EPSS score is not available, but the vulnerability requires an authenticated user and can be abused by compromised or malicious accounts. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The lack of a read‑permission check means that an attacker can trigger state changes or infer the existence of resources without direct read access, representing a moderate risk that should be mitigated through access controls or temporary workarounds.