CVE-2025-52898: Frappe account takeover via password reset token leakage
Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52898?
CVE-2025-52898 is considered a high severity vulnerability as it allows unauthorized access to user password reset tokens.
How do I fix CVE-2025-52898?
To fix CVE-2025-52898, upgrade to Frappe Framework version 14.94.3 or later, or version 15.58.0 or later.
Who is affected by CVE-2025-52898?
CVE-2025-52898 affects self-hosted instances of the Frappe Framework prior to versions 14.94.3 and 15.58.0.
Can CVE-2025-52898 be exploited on all installations of Frappe?
No, CVE-2025-52898 can only be exploited on self-hosted instances configured in a specific way.
What are the implications of CVE-2025-52898 if exploited?
If exploited, CVE-2025-52898 can allow attackers to gain unauthorized access to users' password reset tokens, compromising user accounts.