CVE-2026-109600
5.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Disabled users can continue reading sensitive document updates via email notifications. The attacker only needs an offboarded or disabled account that previously followed documents.
Root cause
The notification system sends Document Follow emails without verifying if the recipient's user account is disabled.
Affected systems
Frappe Framework before 15.118.0 and 16.x before 16.31.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade Frappe Framework to version 15.118.0 or 16.31.0 or later. If updating immediately is not possible, manually unfollow all documents for offboarded or disabled user accounts.
$ bench update --apps frappeAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.