VULNERABILITY INTELLIGENCE

CVE-2026-66000

CVSS score2.3 LOW

EPSS probability0.45%

CISA KEVNot currently listed

Published2026-08-07

Last modified2026-09-08

Description

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.