---
id: CVE-2023-54411
title: >-
  Frappe framework before 13.32.0 uses weak authentication for print view
  access, because the print view key can be derived from data exposed by other
  whitelisted API endpoints
summary: >-
  Frappe framework before 13.32.0 uses weak authentication for print view
  access, because the print view key can be derived from data exposed by other
  whitelisted API endpoints. Attackers can generate a valid key to view
  documents through …
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-290
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T23:17:17.907'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-54411'
references:
  - url: 'https://github.com/frappe/frappe/security/advisories/GHSA-7xv4-ggpj-g48q'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/frappe-before-13.32.0-weak-authentication-via-print-view-key
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T00:09:02.607Z'
---

## Overview

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.