CVE-2026-66000

Frappe (full-stack web framework) has an unrestricted access issue in Document Follow notifications prior to versions 16.23.0 and 15.112.0, where recipient permission checks are not re-evaluated for email data. This allows users whose access has been revoked or reduced to continue receiving docum...

CVE-2026-66000 Frappe: Unrestricted access to Document Follow APIs

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...

EUVD-2026-54573

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue i...