Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata.
No released fixed version is available as of this review.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/frappe/frappe/commit/91155d12deba4426cf33196805da77bc78c5cde1
security-advisories@github.com
https://github.com/frappe/frappe/commit/aeb93abe6b217ea0ae27253ef105ad6d0803613e
security-advisories@github.com
https://github.com/frappe/frappe/pull/39760
security-advisories@github.com
https://github.com/frappe/frappe/security/advisories/GHSA-rx6h-4p83-m76x
security-advisories@github.com