CVE-2025-30214: Frappe vulnerable to information disclosure leading to account takeover
Impact Making crafted requests could lead to information disclosure that could further lead to account takeover.
Workarounds There's no workaround to fix this without upgrading.
Credits Thanks to Thanh of Calif.io for reporting the issue
Other sources
Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/frappeto a version that resolves this vulnerability.Fixed in 15.51.0 - Upgrade
Upgrade
pip/frappeto a version that resolves this vulnerability.Fixed in 14.89.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.89.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.51.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30214?
CVE-2025-30214 is classified as a medium severity vulnerability due to its potential for information disclosure and account takeover.
How do I fix CVE-2025-30214?
To resolve CVE-2025-30214, you must upgrade to Frappe version 15.51.0 or higher if you're currently using version 15.0.0 to 15.51.0 or upgrade to version 14.89.0 if on an earlier version.
What does CVE-2025-30214 impact?
CVE-2025-30214 affects the Frappe framework, specifically within versions 15.0.0 to 15.51.0 and below 14.89.0.
What are the consequences of CVE-2025-30214?
Exploitation of CVE-2025-30214 can result in unauthorized information disclosure, potentially leading to account takeover.
Is there a workaround for CVE-2025-30214?
No, there are no effective workarounds for CVE-2025-30214; the only solution is to upgrade the software.