The flaw allows an attacker to enumerate valid usernames by sending unauthenticated requests to the reset_password endpoint of the Frappe web framework. This results in a security feature failure (CWE-203) that exposes a list of active user accounts without requiring authentication.

All Frappe installations running a version earlier than 16.16.0 or 15.106.0 are vulnerable. The affected component is the publicly reachable reset_password endpoint, which can be accessed without authentication.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of < 1% indicates a very low probability of active exploitation. The CVE is not listed in the CISA KEV catalog. Based on the description, the vulnerability can be triggered by submitting unauthenticated HTTP POST requests to the reset_password endpoint, which is publicly reachable from any network that can contact the web application. No additional privileges are required for exploitation.