What is CVE-2025-30214?

CVE-2025-30214 is a high-severity vulnerability in Frappe, classified under Information Disclosure. CVSS score: 7.5/10. Published 2025-03-25.

How severe is CVE-2025-30214?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2025-30214 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Frappe

CVE-2025-30214

Frappe is a full-stack web application framework. Prior to versions 14.89.0 and 15.51.0, making crafted requests could lead to information disclosure that could further lead to account takeover. Versions 14.89.0 and 15.51.0 fix the issue. There's no workaround to fix this without upgrading.

Vulnerability class: Information Disclosure

EPSS: 0.004 (32.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Frappe — versions < 14.89.0, >= 15.0.0, < 15.51.0

Weakness classification (CWE)

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2025-30214?: CVE-2025-30214 is a high-severity vulnerability in Frappe, classified under Information Disclosure. CVSS score: 7.5/10. Published 2025-03-25.
How severe is CVE-2025-30214?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2025-30214 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.