---
id: CVE-2023-54407
title: >-
  Frappe 14.x before 14.45.0 contains an information disclosure vulnerability
  that allows users with error log access to view secrets stored in local
  variables captured in tracebacks
summary: >-
  Frappe 14.x before 14.45.0 contains an information disclosure vulnerability
  that allows users with error log access to view secrets stored in local
  variables captured in tracebacks. Attackers who can read error logs can
  extract plaintext…
severity: medium
cvss: 4.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:17.230'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54407'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-38fg-mjcm-3hc6'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-14-x-before-14.45.0-information-disclosure-via-error-log-tracebacks
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.605Z'
---

## Overview

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.