CVE-2026-66058

MediumCVSS 5.3

Published: 07/08/2026(UTC)Updated: 10/08/2026(UTC)Translated: 08/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

In the Frappe framework before versions 16.20.0 and 15.112.0, an authenticated user can gain unrestricted access to the Document Follow API (update_follow).

Risk Assessment

An authenticated user can manipulate document subscriptions of other users, potentially leading to unauthorized information access or disruption.

Recommendation

Upgrade Frappe to version 16.20.0 or 15.112.0, which include the fix.

Original NVD description (English source)

Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.