CVE-2026-109600: Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Q: Which deployments are affected?

Deployments running Frappe Framework versions before 15.118.0, or 16.x versions before 16.31.0, are affected.

Q: What conditions are required for information disclosure?

A user must have followed documents before their account was disabled. When activity occurs on those followed documents, the disabled account can continue receiving email notifications containing updates.

Q: Are disabled accounts fully prevented from receiving document-related information?

No. Disabled accounts may still receive Document Follow email notifications for documents they followed before the account was disabled, even though their access should have been revoked.

Published Oct 12, 2026

Updated

Frappe Framework before 15.118.0 and 16.x before 16.31.0 does not check whether a user account is disabled before sending Document Follow email notifications. A disabled user who previously followed documents continues to receive email updates about activity on those documents after their access should have been revoked.

Affected Software

1 affected component

Frappe Frappe Framework<15.118.0, >=16.0.0<16.31.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Frappe Framework to a version that resolves this vulnerability.
Fixed in 15.118.0
Upgrade
Upgrade Frappe Framework to a version that resolves this vulnerability.
Fixed in 16.31.0

Event History

Oct 12, 2026

CVE Published

via MITRE·10:21 PM

Data Sourced

via MITRE·10:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments running Frappe Framework versions before 15.118.0, or 16.x versions before 16.31.0, are affected.

What conditions are required for information disclosure?

A user must have followed documents before their account was disabled. When activity occurs on those followed documents, the disabled account can continue receiving email notifications containing updates.

Are disabled accounts fully prevented from receiving document-related information?

No. Disabled accounts may still receive Document Follow email notifications for documents they followed before the account was disabled, even though their access should have been revoked.

CVE-2026-109600: Frappe before 16.31.0 Improper Access Control in Document Follow Notifications

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What conditions are required for information disclosure?

Are disabled accounts fully prevented from receiving document-related information?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What conditions are required for information disclosure?

Are disabled accounts fully prevented from receiving document-related information?