CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

CVE-2026-109600

The Frappe Framework is affected by an improper access control vulnerability in its Document Follow email notifications system. Specifically, versions before 15.118.0 and 16.x before 16.31.0 fail to verify if a user account is disabled before sending automated email updates. As a result, a disabl...

CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

CVE-2026-109600 Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access...

EUVD-2026-54573

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...