CVE-2026-109600: Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 15.118.0 - Upgrade
Upgrade
Frappe Frameworkto a version that resolves this vulnerability.Fixed in 16.31.0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments running Frappe Framework versions before 15.118.0, or 16.x versions before 16.31.0, are affected.
What conditions are required for information disclosure?
A user must have followed documents before their account was disabled. When activity occurs on those followed documents, the disabled account can continue receiving email notifications containing updates.
Are disabled accounts fully prevented from receiving document-related information?
No. Disabled accounts may still receive Document Follow email notifications for documents they followed before the account was disabled, even though their access should have been revoked.