CVE-2026-109600
Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
| CWE | CWE-862 |
| Vendor | frappe |
| Product | frappe |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for frappe frappe
Be the first to know when new medium vulnerabilities affecting frappe frappe are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
frappe / frappe
0 < 15.118.0 16.0.0-beta.1 < 16.31.0
References
Credits
🔍 robinroy03 AarDG10