Vulnerabilities CVE-2026-66000

CVE-2026-66000

Low

Open

TLP:CLEAR

Frappe: Unrestricted access to Document Follow APIs

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.

Details

CVSS Score: 2.3
EPSS Score ⓘ: 0.26%

17.5th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Confidence: 90%
Published: Aug 7, 2026
Last Modified: Aug 7, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.