CVE-2023-54407: Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks

Q: Who can exploit this issue?

A user who has permission to read Frappe error logs can exploit it. The issue requires authenticated, high-level privileges to access those logs.

Q: What information may be exposed?

Tracebacks can capture local variables, which may contain plaintext secrets. Examples include credentials and keys present in local variables when an error occurs.

Q: Which deployments need remediation?

Frappe 14.x deployments earlier than 14.45.0 are affected. Upgrading to 14.45.0 or later addresses the affected version range.

Q: What can be done if an upgrade cannot happen immediately?

Restrict access to error logs to only trusted administrators, since reading those logs is the prerequisite for extracting exposed secrets. Review existing error logs for plaintext credentials or keys and rotate any secrets found there.

Published Oct 12, 2026

Updated

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

Affected Software

1 affected component

Frappe frappe<14.45.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A user who has permission to read Frappe error logs can exploit it. The issue requires authenticated, high-level privileges to access those logs.

What information may be exposed?

Tracebacks can capture local variables, which may contain plaintext secrets. Examples include credentials and keys present in local variables when an error occurs.

Which deployments need remediation?

Frappe 14.x deployments earlier than 14.45.0 are affected. Upgrading to 14.45.0 or later addresses the affected version range.

What can be done if an upgrade cannot happen immediately?

Restrict access to error logs to only trusted administrators, since reading those logs is the prerequisite for extracting exposed secrets. Review existing error logs for plaintext credentials or keys and rotate any secrets found there.

CVE-2023-54407: Frappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Which deployments need remediation?

What can be done if an upgrade cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information may be exposed?

Which deployments need remediation?

What can be done if an upgrade cannot happen immediately?