Auth bypass in Frappe

CVE-2026-66000

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced…

Vulnerability class: Broken Access Control

Affected products

  • Frappe — versions >= 16.0.0-beta.1, < 16.19.0, >= 15.0.0, < 15.109.0

Weakness classification (CWE)

References