The CVSS 5.3 rating for CVE-2026-53569 materially understates operational risk. The toggle_like endpoint in frappe/desk/like.py operates as a universal document-existence oracle across the entire Frappe ecosystem—any authenticated user who knows or guesses a document ID can probe whether that document exists. The API response distinguishes between success (document exists and the operation succeeded) and failure (document doesn't exist or isn't likeable), enabling systematic enumeration across every doctype in the system, including records the attacker has zero permission to read.
This enumeration capability is the primary concern. While the metadata mutation aspect—writing to the _liked_by field—creates audit artifacts that could theoretically be detected, the enumeration itself is silent. An attacker builds a complete inventory of document topology: customer records, invoices, employee files, any custom doctype. That map persists even after a hypothetical patch, creating permanent information asymmetry.
The absence of a patched version amplifies this significantly. IDOR vulnerabilities with imminent fixes warrant lower temporal scores; a confirmed IDOR with no remediation path forces defenders into compensating controls—API rate limiting, routing middleware, or endpoint disabling—none of which address a framework-level component operating universally across all doctypes.
The enumeration vector is the more dangerous path. Metadata tampering creates noise and potential forensic traces. But enumeration is silent reconnaissance that builds the targeting map for subsequent attacks. The critical question for defenders: if this single endpoint exposes a universal document existence oracle, what other universal endpoints exist in the same codebase?