CVE-2026-109600

EUVD-2026-98163
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 13.6%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
frappefrappe
𝑥
< 15.118.0
CNA
frappefrappe
𝑥
< 16.31.0
CNA
Common Weakness Enumeration
References
https://github.com/frappe/frappe/security/advisories/GHSA-55m4-gj6h-q6rc
https://www.vulncheck.com/advisories/frappe-before-16.31.0-improper-access-control-in-document-follow-notifications