The flaw in the Frappe framework permits an authenticated user with limited privileges to retrieve fields from linked DocTypes through the REST API using dot‑notation syntax. Because the framework does not consistently enforce the linked DocType’s own permission rules when the record is accessed via the API, the user can read confidential data that should be restricted. This vulnerability rests on an improper authorization check (CWE‑863).

Any installation of frappe running a version earlier than 15.115.0 is affected. The issue exists across all DocTypes that are referenced through Link fields and exposed via the REST API; any authenticated user who can submit API requests is potentially able to exploit the bypass.

The CVSS score of 7.1 indicates a high severity level. Exploitation requires only an authenticated low‑privileged account and a specially crafted REST request; no additional privileges or code execution are necessary. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, but the dependence on standard API usage makes it realistic for attackers to leverage once an account is compromised.