The flaw resides in Frappe’s public request‑data web form and the PersonalDataDownloadRequest class. Responses differ in shape when the supplied email address is associated with a registered account versus when it is not, exposing a user_name field and influencing persistence behavior. An attacker can exploit this deterministic difference by submitting many email addresses and comparing the resulting responses, thereby enumerating which addresses are registered on the system. The impact is a moderate information disclosure; the attacker learns user identities but does not gain direct access to user data or administrative privileges.

Frappe (full‑stack web application framework) versions prior to 15.115.0 and 16.27.0. Earlier releases of the framework are affected, while the mentioned releases and later contain the fix.

The CVSS score of 6.9 classifies the vulnerability as moderate. The EPSS score is not available, indicating that current data does not reveal the likelihood of exploitation; the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. The most likely attack vector is remote via HTTP, where a threat actor can send unauthenticated requests to the public endpoints and compare responses. Because the vulnerability relies solely on response shape without authentication, the exploitation effort is low, making it a realistic concern for exposed installations.