A flaw in the Frappe framework allows an attacker to bypass field-level permissions when following a document. The compromised code path removes checks that normally restrict access to sensitive DocType fields, thereby exposing data that should be hidden. According to the CVE report this issue is implemented as CWE-863 and carries a CVSS score of 5.3, indicating moderate‑to‑high impact.

Affected products are Frappe applications running any version before 16.20.0 and 15.112.0. The fix is available in 16.23.0 and 15.112.0. Systems that have not applied these updates are exposed to the bypass.

The vulnerability is rated 5.3 on the CVSS scale and no EPSS score is available. It is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the likely attack vector involves the use of the Document Follow feature, which could be triggered by an authenticated user with limited role permissions or potentially by an unauthenticated user if the follow endpoint is exposed. Successful exploitation would allow the attacker to read restricted fields on documents visible to the role, impacting data confidentiality and potentially violating compliance requirements.