CVE-2026-66000CWE-863broken-access-control

CVE-2026-66000

published August 7, 2026

CVSS
2.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.

The record
Technical detail
CVSS
2.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-07T23:18Z
References (3)
https://github.com/frappe/frappe/commit/0914acb998004b3878eb5cf57b765115305b49a6 · [email protected]https://github.com/frappe/frappe/commit/b02c1aec2c75eb0819cc6730dd230c2acb0fa60d · [email protected]https://github.com/frappe/frappe/security/advisories/GHSA-wcm9-vvcc-r8pr · [email protected]
EPSS history
Timeline
  • 07 AUG 18:25Z
    Frappe: Unrestricted access to Document Follow APIs
    cvelistv5