CVE-2026-66000
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.
Risk Assessment
Users who lost permissions may still receive sensitive document data, violating access control and potentially leading to information leakage.
Recommendation
Update Frappe to version 16.23.0 or 15.112.0 (depending on the used line), which contain the fix. After updating, verify that notifications are sent only to authorized users.
Original NVD description (English source)
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.